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SUMMARY OP SUBTECT MATTER 

TO: Members of the Subcommittee on Aviation 

FROM: Committee on Transportation and In&astnicture, Oversight and Investigations 

Majority Staff 

SUBJECT: FAA Aircraft Certification; Alleged Regulatory Lapses in the Certification and 
Manufacture of the Eclipse EA-500 

Purpose op Hearing 

The Subcommittee on Aviation of the Committee on Transportation and In&asttucture will 
meet on Wednesday, September 17, 2008 at 10:00 a.m. in 2167 Rayburn House Office Building to 
review an oversight investigation. Ibis investigation concerned allegations that the Federal Aviation 
Administration (FAA) rushed to approve both the type (TQ and production certifications (PC)' of a 
new aircraft, the Eclipse EA-SOO, despite safety concerns with the design and manufacturing of the 
aircraft raised by a number of FAA certification engineers and aviation safety inspectors. 


FAA Aircraft Certification Service 

The FAA maintains oversight of manufacturers through its Aircraft Certification Service 
(AIR). AIR is the FAA organization responsible for: 1) administering safety standards governing the 
design, production, and airworthiness of civil aeronautical products; 2) overseeing design, 
production, and airworthiness certification programs to ensure compliance with prescribed safety 
standards; 3) providing a safety performance management system to ensure continued operational 
safety of aircraft; and 4) working with aviation authorities, manufacturers, and other stakeholders to 
help them successfully improve the safety of the international air transportation system.^ 


* Tile FAA must issue both a type certificate and a production certificate fiir every new tyye of aircraft. The procedures 
for approvai ate coveted in detail in FAA Order 8110.<k, which was last revised March 28, 2007. 

3 From the F/Ut website, http;/ / www.faa.gov/abouT/ office„org/hcadquarters_offlccs/ avs/offices/air/ 
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AIR is organized into the Office of die Director and four divisions located at the 
Washington, DC Headquarters, and four geographic directorates. The Aircraft Certificadon Service 
headquarters offices and the directorates share responsibility for the design and production 
approval, airworthiness certification, and continued artworthiness programs of all U.S. civil aviation 
products. 

FAA Approval op a New Aircraft 

When a manufacturer initiates plans to develop and build a new aircraft, it must receive two 
separate approvals from the FAA before the new aircraft can enter service. First, the design of the 
aircraft must be proven to meet all applicable safety regulations pertaining to aircraft design. Ihis is 
commonly referred to as Type Cerrifieatinn (TQ, and to obtain approval of a TC, a manufacturer 
must demonstrate that the aircraft can be operated safely, diere are no known significant design 
defects, and that all likely modes of systems malfunction can be overcome in a way that the aircraft 
can be landed safely in an emergency situation. Second, the manufacturer must demonstrate the 
capability to reliably replicate and produce the design successfully in the manufacturing process, and 
this is demonstrated with FAA’s approval of a Production Certificate (PC). FAA issued the TC for 
the EA-500 on September 30, 2006, and it issued the PC on April 26, 2007. 

A TC is a design approval issued by FAA when the applicant demonstrates that a product 
complies with the applicable regulations, which are described in FAA Order 8110.4C’. As defined 
by 14 CFR § 21.41, the TC includes the type design, the operating limitations of the aircraft, 
applicable regulations, and other conditions or limitations prescribed by the Administrator. The TC 
is the foundation for other FAA approvals, including the production certificate (PQ and 
airworthiness approvals. 

A PC is an approval by the FAA to manufacture or alter a product after having shown 
compliance with an approved type design. The FAA issues a PC to a TC holder, or a licensee of a 
TC holder, who meets the requirements of 14 CFR § 21 .135, 21.139, and 21.143, 

Eclipse Aviation and Very Light Jets 

An emerging trend over the last several years has been an initiative by multiple 
manufacturers to design an entirely new class of aircraft commonly referred to as very light jets 
(VLJs). VLJs have been heavily promoted by FAA as a potential solution to congestion around 
larger airports, and as a means to bring a convenient, fast transportation alternative to smaller 
communities that cannot support network commercial ait service. Forecasters have predicted that 
literally thousands of VLJs could enter the National Airspace System (NAS) over the next two 
decades, and these aircraft will operate in the same high altitude airspace as the current Beet of large 
commercial aircraft. 

As the new influx of VLJs enters the system with a new mix of pilot experience and 
technology, the FAA must be vigilant in monitoring the impact on tihe existing NAS and on 
ensuring rigorous safety oversight. In 2006, FAA certified the fint VLJs, the Cessna Mustang, and 
Eclipse EA-SOO. 


^ Federal Aviation Administration, Order 81 1 0.4C, revised Match 28, 2007. 
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Eclipse Aviation was formed in 1998 for the sole purpose of building a radically different, 
high technology, new VLJ. In late 2006, Eclipse unveiled a six-passenger aircraft, which featured 
advanced avionics and a high level of fuel efficiency. Eclipse Aviation issued a press release on 
January 1, 2008 claiming that it had set a new record by completing and certifying 1 04 aircraft in 
only 12 months, surpassing a previous record by Cessna, which certified 100 Citation 500 aircraft in 
18 months.* Approximately 200 EA-500 have been manufactured to date out of about 2,700 aircraft 
ordered. 


Allegations op a Rush to Certification 

A few weeks prior to the April 3, 2008 Full Committee hearing on “Critical Lapses in FAA 
Safety Oversight of Airlines: Abuses of Regulatory Tartnership Programs,’” Odd Committee staff 
were contacted by engineers and safety inspectors in the FAA’s Aircraft Certification Service (AIR) 
and received documentation alleging Aat FAA had inappropriately certified the EA-500 VLJ. The 
allegations suggest that serious design problems with the EA-500 were identified during the 
certification process, and that these deficiencies should have delayed tire issuance of the aircraft’s TC 
and PC. FAA certification engineers and inspectors who insisted on correction of these design 
deficiencies before certification were allegedly relieved of their former duties with the Eclipse 
program by senior FAA management and replaced by those more amenable to management’s desire 
to certify the aircraft by its self-imposed deadline of September 30, 2006. Hiese rumors were 
further fueled by the fact that in the days leading up to September 30, many engineers involved in 
the program felt that they had made tlie case that the aircraft was not ready for certification, and 
they were surprised when the TC was signed on September 30, a Saturday. 

It was further alleged by various informants that Eclipse founder and Chief Executive 
Officer, Vern Raburn,* was very assertive at FAA Headquarters and seemed to have a great deal of 
influence with senior FAA management. The Director of Aircraft Certification, John Hickey, was 
personally involved in pushing the Eclipse certification program and replaced personnel who created 
delays in the process. These allegations raised additional questions about whether the FAA’s culture 
has migrated over time toward overly collaborative relationships with industry. These concerns are 
similar to those aired during the April 3, 2008 Full Committee hearing. 

Concerns about the EA-500 were intensified on June 5, 2008, when an EA-500 jet made an 
emergency landing at Chicago Midway International Airport. On approach to the airport, the flying 
pilot pushed the throttles (fly-by-wire) forward and both engines “ftoze” at full power and were 
completely unresponsive to throttle inputs. The crew quickly shut down one engine by closing the 
fuel supply lever to that engine, and the other engine retarded to idle thrust shortly thereafter, but 
the other engine continued to be unresponsive to throttle inputs. The pilots declared an emergency, 
were cleared to land on any runway, and were able to land tire plane without injury to the two pilots 
or two passengers. The airplane had accumulated only 238 hours and 192 cycles at the time of the 
incident. This situation could easily have been a fatal accident. The crew was fortunate that shutting 
down one engine caused the second engine to suddenly toll back to idle thrust Ironicaly, that 
incident revealed a software defect indicating non-compliance with certification requirements that 
each power plant control must be completely independent of tlie others. 


■t Eclipse Aviation Press Release, January 1, 2008, www.cclipscaviation.com/compaay/ news/, 
t Mr, Rabum was released as CEO by the Eclipse Aviation Corporation Board of Directors in late July 2008 and 
subsequently left the company. 
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Following the incident, the NTSB issued uigent recommendations to the FAA. They 
advised that mandatory inspections be required on ail EA-500 airplane throttle quadrants to ensure 
that pushing the throttle levers against the maximum power stops will not result in an engine control 
failure, that all units failing inspection should be replaced, and that the replacement parts must be 
similarly inspected. NTSB also recommended that FAA issue an airworthiness directive (AD) which 
would require Eclipse Aviation to immediately develop an emergency procedure for the dual engine 
control failure that occurred and incorporate the procedure into the airplane flight manual and quick 
reference handbook. NTSB also raised a theory Aat the problem could be due to flaws in the 
avionics software logic*, and both FAA and Eclipse later confirmed these software flaws. 

On June 12, the FAA heeded the NTSB’s recommendations and issued an emeigency AD, 
which effectively grounded 200 jets until they could be inspected. AD 2008-13-51 requires a pilot 
inspection of the thrust quadrant assembly (TQA) on each plane in advance of the aircraft’s next 
flight. The NTSB final analysis of this software failure mode has not been completed, but it is of 
concern in light of the questions surrounding the “non-standard” software certification of the EA- 
500. 


As a result of this incident, FAA re-examined its cetdfication of the software that controls 
the engines and discot'ered software logic flaws that should have been resolved before approving the 
design with issuance of the TC and PC. On June 26, 2008, FAA official Michele M. Owsley sent a 
letter to Eclipse Aviadon informing the company that “our review of the design information thus far 
indicates several design regulatory non-compliances” (witli certification requirements],’ Ms. Owsley 
is the FAA official who also signed the original TC. This letter advised Eclipse to develop an 
approach to bring the aircraft design into certification compliance. 

In a July 16, 2007 memorandum obtained by OIG investigators, Ms. Owsley stated the 
following: 

During the TC, we accepted a lesser level of validation and consequently the FAA 
ended up doing a great deal of developmental flying with Eclipse, a task that the 
company should accomplish prior to FAA TIA preliminary aircraft] testing. In 
conducting a lessons learned review after the initial TC, we identified the level of 
software certification as an issue we would treat differently on subsequent 
certifications.* 

On August 20, 2008, the FAA announced that it had begun, on August 1 1 , 2008, an unusual 
“Special Certification Review” led by a former Boeing safety expert, which would be concluded in 
30 days. The FAA said that special reviews are “used regularly” by the FAA, and it dted 6 
occurrences in the last 10 years.’ This panel has concluded its work, and remains steadfast in 
maintaining the FAA position that the certification was conducted properly, despite the findings of 


* Safety Recommendation A-08-46 and -47, National Transportation Safety Board, June 12, 2008, 

’ FAA letter from Michele M Owsley, Manager, Airplane Certification Office, Rotorcraft Directorate to Randy Griffith, 
Certification Manager, Eclipse Aviation, June 26, 2008. 

* Written Testimony before the Subcommittee on Aviation, Committee on Transportation and Infrastructure, Calvin L. 
Scovel III, Inspector General, Department of Transportation, September 15, 2008. 

^ FAA Press Release, August 20, 2008. 
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the OIG.'° Mi. Ronald Wojnai was a member of this “special review” team, and he was also in 
chaise of the original Eclipse piodaction certification process after the previous manager (David 
Downey) was reassigned (see "Summa^ afpinMugsandAUegationi' below). In addition, the special 
review team focused exclusively on four issues related to issuance of tlie type certificarion. The 
FAA review did not examine any of the issues associated with the production certification, which is 
a major focus of the OIG investigation, as well as later reported problems with the aircraft.” 

FAA Customer Service iNmATrvE fCSll 

In previous Committee hearings, it has been noted that partnership programs, in which the 
airlines and aircraft manufacturers are treated more as the FAA’s “customers” as opposed to 
regulated entities, have become firmly rooted in recent FAA culture. The FAA’s website 
prominently features the FAA’s one sentence statement entitled "Our Vision” which states, “Our 
vision is to improve the safet)' and efficiency of aviation, while being responsive to our customers 
and accountable to the public.”'* 

In the April 3, 2008 Full Committee hearing, “Critical Lapses in FAA Safety Oversight of 
Airlines; Abuses in Regulatory ‘Partnership Programs,”’ the Customer Service Initiative (CSl) 
figured prominently in the questions addressed to the FAA by Members. It was suggested that FAA 
placed too much emphasis on airlines and manufacturers as the “customer” as opposed to the public 
being FAA’s only customer, and that FAA appeared to place a continued emphasis upon promoting 
aviation as opposed to its only statutory mandate, safety . Moreover, FAA documents describing the 
CSI clearly suggest that the FAA views certificate holders (e.g. airlines, manufacturers, and other 
regulated entities) as the customer. Following the Valujet accident in 1996, legislation was enacted 
that specifically removed the FAA’s “promotion of aviation’’ mandate and required FAA to focus 
exclusively on safety as the highest priority.’* Several Members noted that the CSI appeared to 
create conflicts with FAA’s safety mandate, and that the traveling public should be the FAA’s only 
customer. 

The Aircraft Certification Service has its own version of the CSI.’* As with the CSI 
procedures implemented in the Flight Standards Service, an applicant has the right to appeal any 
FAA certification decision to higher authorities. This document is replete with references to the 
certificate holder or applicant as the "customer” of the FAA. According to the DOT OIG, Eclipse 
made use of the CSI in filing at least one formal appeal of a certification decision, and may have 
made other informal appeals.’* 


“ Briefing of the FAA BA-500 Special Certification Review Team to Committee Staff, September 1 2, 2008. 

' ' O&I Staff convetsarion with Megan Rosia, FAA Assistant Admiiristrator for Government and Industry Affairs, 
September 15, 2008. As of September 16, 2008, Odrl Staff have not been provided witli a copy of the Special 
Certification Review Team report. 

Federal Aviation Administration, www.faa.gov/about/mission/. 
n Federal Aviation Reauthoiiaation Act of 1996, Public Law 104-264, Section 401, Enacted October 9, 1996. 

'■* Aircraft Certification Service, Customer Service Initiative Customer Guide, Federal Aviation Administration, July 1 1, 
2008. 

t* See note 8. 


5 



xii 

Summary op Findings and Allegations 

TScI Committee O&I staff immediately requested assistance from the Department of 
Transportation (DOT), Office of Inspector General (OIG) to verify the allegations of the various 
FAA employees previously associated with the Eclipse certification program. The OIG 
investigation confirmed many of the allegations and raised numerous significant concerns and 
r^ulatory policy questions. 

PAA Permitted Exceptions to rrs Usual Design Certification Process 

According to OIG investigators and FAA personnel who have been interviewed by 
Committee investigators, tlie FAA deviated from the normal certification process in various ways 
and before significant design problems were resolved. OIG found that many of these design 
problems continue today. These include problems with the avionics software, as well as airspeed 
and altitude indicator problems. More importantly, recent events reported by Eclipse operators 
indicate that many problems identified during the design certification have still not been resolved, 
including erroneous stall warnings, cockpit display distortions, and flap movement Mures. 

Avionics Software Issues 

The OIG testimony states that given the EA-500’s dependence on software, it would have 
expected FAA to perform rigorous analysis and testing prior to issuance of the TC. They found, 
however, that before issuing the TC, FAA did not require this software to be approved to the 
accepted industry standard (DO-178B). Instead, FAA accepted wliat the OIG characterizes as an 
"lOU" from Eclipse, which stated that the aircraft would meet the accepted standard at a later date. 
While those actions were not a violation of Federal Aviation Regulations (FARs) and are not 
unprecedented, OIG was concerned because the EA-500 was a brand new company attempting to 
certify a brand new aircraft. Nonetheless, they were allowed to deviate from the accepted indnstty 
standard, and the OIG was particularly concerned that the FAA applied a “less stringent” standard 
to the avionics software design, which the aircraft relies heavily upon for operation. Users have 
since repotted problems directly related to the EA-500 software such as cockpit display failures. 
When the TC was issued, Eclipse had only completed 23 of the 65 tests needed to meet the 
approved industry standard for software certification. “ As discussed above (see “Alhgatiom of a R*h 
to Csrti^eatioi^f the FAA manager who approved the Hclipse TC lias since expressed concerns over 
the process used for certifying the avionics software. 

Airspeed and Altitude Indicator Problems fPitot Static Svsteml 

The EA-SOO design for the pitot static system (which provides airspeed, altitude, and rate of 
climb information), did not include a drainage system for excess moisture, contrary to the normal 
design standard for this system. A moisture and icc contaminated pitot static system was a major 
causal factor in the Air Florida accident in 1982 where a B-737 crashed into the 14* Street Bridge in 
Washington, D.C. shortly after takeoff'’ FAA can and did approve an “Equivalent Level of Safety” 
(ELOS) exemption for the EA-500 pitot static system. The Fort Worth certification team was not 


See note 8. 

National Transportation Safet]' Board Abstract, Air Florida, Inc., Boeing 737-222, N62AF, Collision with 14* Street 
Bridge near Washington National Airport, Washington, DC, January 13, 1982 
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satisfied with the proposed design and did not want to approve it. As a result, approval authority 
was transferred to a different FAA office, which did approve an ELOS exemption for the original 
design of the pitot static system,'® 

The system was initially tested in the dry climate of New Mexico and experienced no 
significant early problems. Once the aircraft began operations in more humid climates, problems 
began occurring with moisture contamination, causing altitude and airspeed deviations. 
Subsequently, FAA has issued several Airworthiness Directives (ADs), the latest on September 9, 
2008, requiring correction of this problem, even though it was noted by the team prior to 
certification.” 

Intermittent Erroneous Stall Warning s 

The EA-500 experienced problems with the stall warning system both before and after the 
issuance of the TC and PC. FAA regulations state that . . the stall warning must not occur during 
takeoff with all engines operating, a takeoff with one engine inoperative, or during approach to 
landing.” According to FAA pilots who spoke with both OIG and Committee investigators, these 
inappropriate warnings can be extremely dangerous particularly when landing because it has a high 
probability of causing pilots to take urgent actions based upon a belief that they ate entering a stall. 

FAA management disputes that there is a teal problem and attributes the warnings to flying 
the aircraft at inappropriate speeds. However, these warnings still occur today, and pilots operating 
the aircraft dispute that die incidents of stall warnings ate entirely due to speed control problems in 
operation. This issue is still under investigation.® 

Cockpit Display Failures 

The EA-500 experienced numerous incidents of screen blanking or freezing both before and 
after the issuance of the TC. In order to award tire design certificate. Eclipse agreed to fix tire 
software “bug” causing these failures after receiving the TC. Eclipse reported to FAA that it had 
fixed the problem neady 4 months after issuance of the TC, and FAA also required Eclipse to 
develop an emergency procedure for screen blanking in the aircraft flight manual However, a 
number of additional incidents have been filed in service difficulty reports (SDRs) between August 
2007 and May 2008.®' 

Flap Movement Failures 

FAA regulations require that the main wing flaps must be designed so that the occurrence of 
flap failute is "extremely improbable.” However, both before and after issuance of the TC, the 
aircraft had problems with flaps sticking in position. After issuance of the TC, but before issuance 
of the PC, the FAA’s Flight Standardization Board (FAA test pilots), recommended that it be 
restricted to two-pilot operation stating in part 


** See note 8. 

w Federal Aviation Adcunistration, Aiiwortiuness Directives; Hatco Labs, Inc. Pitot/AOA Probes (Part Numbeta 
100435-39» 100435-39-001, 100435-40, and 10043540-001), September 9, 2008.- 
^ Sec note 8. 

2' Ibid. 
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The immediate issue that caused the Board to reach this conclusion is the repeated 
flap failures that have been occurring during recent flights. These failures are now 
approaching one flap failure for every 10 attempts to operate the flaps. The flight 
control problem affects safety of flight and acceptable operational reliability.^ 

FAA Headquarters officials overruled the Board’s recommendation and approved the EA-500 for 
single-pilot operations after receiving a CSI complaint from Eclipse.^ 

Service Difflculty Reports 

The EA-500 has logged a large number of Service Difficulty Reports (SDRs)“ during its 
relatively short period of time in service. Information obtained by DOT OIG investigators 
indicated 81 SDRs submitted for 28 Eclipse aircraft in service between August 2007 and May 2008. 

According to the FAA, none of the current problems were identified during the design 
certification, but this is contrary to what is reported by certification engineets and inspectors, who 
were assodated with the certification program and FAA records obtained by OIG. For example, in 
the two weeks immediately prior to the issuance of the TC on September 30, 2006, Eclipse test flew 
the aircraft for 100 hours as a pre-condition for receiving certification. During those flights the 
pilots experienced: 1) at least 4 inappropriate stall warnings during landing; 2) 10 instances of screen 
freezing or blanking; and 3) 18 cases of either actual flap failure or flap failure messages on the 
cockpit display. As a result, the OIG has concluded that FAA had sufficient reason to know about 
the problems still occurring with the aircraft today.” 

The European Aviation Safety Agency (EASAI Has Declined to Certify the EA-500 

It is also significant that the European Aviation Safety Agency (EASA) has not granted a TC 
to the EA-500 due to many of the defects that were originally reported by FAA engineers and 
inspectors. FAA and EASA have “harmonized” certification procedures such that an FAA TC or 
PC is usually automatically recognized by EASA (and vice versa). EASA has concerns that the EA- 
500 does not meet the FAA/EASA harmonized certification standards to the extent that the agency 
will not recognize FAA’s certification without further testing and review. 

FAA Awarded Ecupse a Production Cektipicate Even Though the Company Failed 
TO Demonstrate the abiutyto Repucate the Approved design 

FAA granted Eclipse a PC on April 26, 2007. Prior to receipt of this certification, every 
aircraft manufoctured by Eclipse was required to receive an FAA inspection and certificate of 
airworthiness. However, once Eclipse received the PC, it could mass-produce its aircraft without a 
requited FAA inspection. 


»Ibid. 

” Ibid. 

SDRs ai% repotts submitted by operators when a failure or defect occurs in airciaft stmetum or is detected if diat 
failure or defect has endangered or may endanger die safe operation of an aircraft. 

^5 See note 8. 


8 



XV 


Manufactutets arc required to undergo an evaluation by an FAA 'Production Certification 
Board (PCB) before receiving approval for a PC. The primary task of the PCB is to ensure that 
corrective actions for any area of design non-compliance ate accomplished prior to PC approval. 

The OIG found that FAA issued the PC -without resolving a number of deficiencies identified by 
the PCB, -which completed its review on April 12, 2007, approximately 2 weeks prior to PC 
approval. The PCB also found significant problems with Eclipse suppliers. Hie PC was awarded 
with 13 known production problems that had not been addressed, and the PCB did not close those 
open items until almost a year later, in February 2008. 

Eclipse encountered numerous problems replicating its own aircraft design on the assembly 
floor both before and after receiving its certificate. OIG found that manufacturing deficiencies were 
missed by Eclipse inspectors serving as FAA "designees” (see ODAR discussion below). For 
example, in one instance Eclipse presented an aircraft to FAA for airworthiness certification with 
approximately 20 ainvotthiness deficiencies, even though it had been signed off with no non- 
conformities by an Eclipse FAA designee. The OIG investigation found production problems 
associated with previously identified design problems. In addition, OIG found: 1) Eclipse supplier 
quality control issues; 2) significant problems that were not identified by Eclipse inspectors; and 3) 
deficiencies in the manufacturing qualitj' assurance program.^ 

Committee investigators also interviewed a number of FAA certification engineers and 
inspectors who confirmed these problems. A number of former Eclipse manufacturing employees 
also contacted the committee wiA reports of serious problems in the production process. 

SENIOR FAA Management Identified Eclipse as a Priority Certification and 
Appeared to be Lenient with the Manufacturer 

Because Eclipse was identified, at top management levels, as a priority for certification, OIG 
concluded there was reason to believe that the FAA may have been excessively lenient with the 
manufacturer. At minimum, this finding raises the concern that FAA may have been more intent on 
promoting aviation and new technology than it was with its safety oversight mandate. A specific 
certification date was included in the ^ 2006 Airciaft Certification Performance Plan,” 

The OIG found that Eclipse complained “they were not getting the service they needed.” 
FAA’s Director of Aircraft Certification Service, John Hickey, was personally involved in the Eclipse 
certification and assigned his former deputy to oversee the project. In March 2007, he removed 
David Do-wney, Rotorcraft Directorate Manager before issuance of the PC for “not actively 
managing the manufacturing process well,” apparently because Mr, Downey refused to sign-off on 
the PC because he believed Eclipse had not met the requirements. In a seven-page letter of 
reprimand sent to Mr. Downey, FAA officials stated that he failed to meet expectations associated 
with meeting its customer service initiatives such as “building relationships with our customers to 
achieve operational results.” In fact, FAA Headquarters officials required that Mr. Downey undergo 
a peer appraisal, and directed that the Chief Operating Officer of Eclipse would be one of the 
individuals appraising his performance in certifying the EA-500.*® It would appear that this was an 


“ Ibid. 

tt Annual Performance Plan, Fiscal Year 2006, FAA Aircraft Certification Service, 2005. 
“ See note 8. 
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obvious conflict-of-interest position for an FAA manager charged with evaluating die safety of a 
new aircraft type, and it is yet another example of the Committee’s previous concerns with the CSI. 

FAA engineers and inspectors initially involved in the Eclipse project were reassigned after 
raising problems with the aircraft’s design and production. According to the FAA, the 
reassignments were related to "performance issues.” Furthermore, FAA officials allegedly pressured 
Mr. Ford Lauer, the San Antonio Manufacturing Inspection District Office (MIDO) manager, to 
sign a document that prohibited FAA inspectors from conducting detailed inspections, and to 
specifically prevent them from looking under die floorboards and removing interiors of the aircraft. 
Due to his concerns about the implicadons of this action, the MIDO Manager purchased 
professional liability insurance . An FAA audit team evaluating the Eclipse for production 
certification was allegedly told to “look no mote than one inch deep” by the newly appointed 
manager.®' The- activities of the FAA manufacturing audit team were significantly curtailed by the 
newly-appointed manager, Mr. Wojnar. Specifically, Mr. WoinaFs newly-implemented production 
certification plan did not require Eclipse employees to remove floorboards or interior panels for 
FAA inspectors. Prior to the establishment of this new plan by the new manager, FAA inspectors 
had been routinely finding numerous deficiencies on aircraft diat had already been inspected and 
“certified” by Eclipse “designated inspectors” (see discussion of '‘Orgamitational Desifftaled 
Ainmrthmss'Kipmintalm (OD./dRj’’below).” 

After multiple occurrences of aircraft being presented to FAA for airworthiness 
certifications with numerous design and production deficiencies, the manager of the FAA 
Manufacturing Inspection Office (MIO) sent an e-mail in February 2007 to Eclipse detailing all of 
the steps that Eclipse needed to accomplish to comply with FAA requirements of gaining an 
airworthiness certificate. In March 2007, this manager was also remot'ed from the project The 
senior FAA official in charge of certification, Mr. Hickey, told Committee staff on September 5, 

2008 that he thought the requirements imposed in the e-mail to Eclipse were "excessive” and “very 
inappropriate,” and that this was the reason for his decision to remove this manager. However, 
other FAA managers, including the supervisor of the removed manager, stated they beliet'ed the e- 
mails were entirely appropriate because FAA is ultimately responsible for certifying the airworthiness 
of each new aircraft. This is defined in FAA Order 8130F.” 

PtganKattpp al D esignated Ainv o fth itt ess Repres en t a tiy e (O.OA R ) 

The FAA approved an Eclipse Aviation request to be authorized as an Organizational 
Designated Airworthiness Representative (ODAR) to perform approved functions on behalf of 
FAA. FAA granted Eclipse Aviation the authority to certify its own aircraft &r earlier than otlier 
manu&cturers, specifically 4 years prior to Eclipse obtaining the TC.“ 

An ODAR is an organization that collectively meets the experience and technical 
requirements of an individual Manufacturing Designated Airworthiness Representative (DAR), and 


^"Wntteii Testimony of Majyetta j. Broyles, Technical Program Specialist, Aircraft Certification Service, FAA. 
rs See note 8. 

51 Ibid. 

55 Ibid. 
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essentially allows a manufacturer to approve its own processes without FAA oversight.” To obtain 
DAR authorization, the manufecturer is required to have sufficient and relevant experience, gj an 
organization, to perform the functions for which the authorization was requested. Since Eclipse is a 
new manufiictuter and had never before designed or manufectured an airplane, it is difficult to 
understand how Eclipse could have the appropriate level of experience requited as an organization 
to qualify for ODAR status. However, it is interesting to note the Eclipse manager of certification 
had recently left FAA to take that position with Eclipse in 2001, with no "cooling off period.” 
Eclipse received ODAR status in September 2002, 4 years before receiving TC approval in 2006.” 

Sin gle Pilot Aircraft Certification 

FAA also granted single-pilot operation certification for the EA-SOO, even though the FAA 
Flight Standardization Board (FSB) had significant concerns about the ability to safely operate the 
aircraft with one pilot and recommended against single-pilot certification. Many EA-500 pilots 
interviewed by the OIG have testified that they do not believe the aircraft can be safely operated by 
a single-pilot, given its complexity, which is essentially equivalent to that of k^er, transport category 
aircraft, which can only be operated by 2 or more pilots. It is significant that the largest operator of 
the EA-500 only alows two-pilot operations with the aircraft The CEO of Eclipse at the time, Mr. 
Rabum, filed a CSI complaint about the FSB recommendation to reject the aircraft for single-pilot 
certification, and the FSB recommendation was reversed by senior FAA management ” 

Other Issues 

It was also found that FAA devoted a disproportionate share of resources to the project in 
order to rapidly certify' the aircraft Some personnel worked 80 hour weeks for months; and they 
were redirected from other certificates to work on the Eclipse. According to FAA documents 
obtained by the OIG, the FAA’s cost for the Eclipse certification was almost $3 million and the 
total hours lo^ed was over double that of a comparable certification project.” 

The DOT OIG is continuing to investigate this case and will attempt to determine if 
problems identified during the certification and manufacturing process have been corrected. They 
are also evaluating the current manufacturing process to determine the effectiveness of the Eclipse 
quality assurance system, the adequacy of training for production personnel, and the competence of 
the FAA designees. 

Summary 

The FAA remains steadfast in its assertion that no Federal regulations were violated. 
However, when the findings and assertions uncovered in this investigation are viewed in total, there 
is a disturbing su^estion that there was a "cozy relationship” and reduced level of vigilance on the 
FAA’s part during both the TC and the PC approval process of the EA-500. Based upon the results 
of the OIG investigation, to date, and the conclusions of the FAA’s “lessons learned review, and — 


n Oiganizationai Designation Authotization Procedures, FAA Order 8100.15, Department of Transportation, Federal 
Aviation Administration, August 18, 2006. 

^ See note 8. 

“Ibid, 
n Ibid, 
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most importantly — the problems that continue to impact pilots, the OIG believes that FAA should 
have exercised greater diligence in certifying the EA-500 design.^’’ 

With the s^nificant risks posed by a new aircraft, powered by new technology, and produced 
by a new manufacturer, it seems logical to have expected the FAA to exercise much greater scrutiny 
than in the average certification program, with an established manufacturer such as Airbus, Boeing, 
Cessna, etc. Moreover, the EA-500 represented a whole new dass of aircraft, and it did not easily fit 
into the FAA’s normal certification regime because the EA-500 has advanced avionics and turbine 
engine technology mote characteristic of a large transport aircraft Its only commonality with a 
tj'pical general aviation aircraft is its l%ht weight and small passenger capacit)’. However, the FAA 
chose to use certification requirements for general aviation aircraft rather than the more rigorous 
requirements that should be required of aircraft with that degree of complexity. 

Instead, FAA seems to have been unusually lenient given the priority it assigned and the 
collaborative relationship that was developed with Eclipse management It seems entirely illogical 
and inappropriate for senior FAA management to assig n itself a date by which an aircraft is to be 
ready for certification approval and then to find reason to actually meet that date, when just days 
prior, numerous FAA personnel were opposed to issuance of the TC. On the contrary, it would 
appear diat the burden of when an aircraft is ready to be certified should fall entirely upon the 
manufacturer, and it should be none of FAA’s concern as a matter of policy. It is clearly not the 
FAA’s responsibilit)' to meet a manufacturer’s certification deadline, which is used to satisfy 
potential customers and company investors. The FAA’s only responsibility should be to respond in 
a timely fashion to an applicant’s approval documentation and to provide a “yes” or “no” decision 
on whether an aircraft is ready for safe certification or not. 

It is also interesting to note that the FAA Rotorcraft Certification Directorate in Ft Worth, 
Texas, which was assigned primary responsibility for evaluating the EA-500, appears to have been 
very diligent in its attempt to adhere to established certification regulations and appears to have 
performed admirably. However, their decisions and recommendations were routinely overruled by 
higher-level FAA management, with “customer service” to Eclipse looming as a strong influence. - 

The Congress removed the FAA’s “promotion of aviation” mandate in 1996.“ The FAA’s 
CSI and recent behavior in other areas suggest that the promotion of aviation is still an integral part 
of FAA’s culture. 

In the Eclipse case, it appears that when design deficiencies were identified that appeared to 
be non-compliant with FAA certification requirements, senior FAA management became personally 
involved, overruled lower-level engineers and inspectors, worked diligently to find “work-arounds,” 
to find "alternative approval rationales and techniques,” and accepted “lOUs” for later compliance. 
In many ways, die certification process in this case was conducted “backwards” ftom the cleat intent 
and requirements of FAA certification regulations. Instead of certifying on the basis of safety alone, 
FAA senior management appeared to be highly motivated to find ways to explain why design 
deficiencies identified by FAA engineers and inspectors as “unsafie” were indeed “flawed,” but they 
were still "acceptable for certification” by simply changing the approval criteria. Indeed, one broad 
policy issue that needs further examination relates to the many "loopholes” FAA has at its disposal 


” Ibid. 

See note 12. 
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to find “akernatitre means of compliance” or “equivalent levels of safety” for ccrdficadon 
regulations. Hius, the allegations and findings in this case are cause for concern and suggest the 
immediate need for a broad policy review of FAA certification practices. 
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HEARING ON FAA AIRCRAFT CERTIFICATION: 
ALLEGED REGULATORY LAPSES IN THE 
CERTIFICATION AND MANUFACTURE OF 
THE ECLIPSE EA-500 


Wednesday, September 17, 2008, 

House of Representatives, 

Committee on Transportation and Infrastructure, 

Subcommittee on Aviation, 

Washington, DC. 

The Subcommittee met, pursuant to call, at 10:00 a.m., in Room 
2167, Rayburn House Office Building, the Honorable Jerry F. 
Costello [Chairman of the Subcommittee] presiding. 

Mr. Costello. The Subcommittee will come to order. 

The Chair will ask all Members, staff and everyone to turn elec- 
tronic devices off or on vibrate. 

The Subcommittee is meeting today to hear testimony on FAA 
Aircraft Certification: Alleged Regulatory Lapses in the Certifi- 
cation and Manufacture of the Eclipse EA-500. The Chair will give 
an opening statement, recognize the Ranking Member for an open- 
ing statement, and as you will note from the witness list, we have 
a number of witnesses. So what we intend to do is give opening 
statements from the Chair and Ranking Member and go directly to 
the witnesses. After my statement, I will, as I said, recognize the 
Ranking Member. 

I welcome everyone to our Subcommittee hearing on FAA Air- 
craft Certification: Alleged Regulatory Lapses in the Certification 
and Manufacture of the Eclipse EA-500. 

For the past few years, I have asked the question, does the FAA 
have adequate resources to accomplish its mission, and in turn, are 
they relying too heavily on its safety record in order to demonstrate 
its ability to keep a safe system? Over these past two years, our 
hearings in the Aviation Subcommittee and the Full Committee 
have demonstrated an agency that is short on resources, low on 
morale and has major problems overseeing its critical safety pro- 
grams. 

Today, the Department of Transportation Inspector General re- 
ports that he will detail alarming problems within the FAA. I am 
extremely disappointed that the FAA, again, lacks the ability to 
oversee its programs, in this case, its certification programs. Unfor- 
tunately, this hearing will show an agency that is as interested in 
promoting aviation and befriending manufacturers as it is in car- 
rying out its number one responsibiiity of protecting the safety of 
the fiying pubiic. 


( 1 ) 
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It is inexcusable and unacceptable to ignore rules, regulations 
and standard practices to accommodate those you have a responsi- 
bility to r^ulate, especially when you have peoples' lives in your 
hands. This Subcommittee and the Congress and the American 
people entrust the FAA to uphold the highest level of safety. Unfor- 
tunately, the FAA's conduct r^arding the certification of the EA- 
500 makes one lose confidence in the agency. 

The aircraft certification and production process is complicated, 
requiring very technical expertise and understanding. When trying 
to do so on an emerging new class of very light jets, like the Eclipse 
EA-500, one would expect the FAA to provide an appropriate 
amount of time and resources to make sure we get it right. Flow- 
ever, questions have been raised by the IG and by current and 
former FAA employees that corners were cut during the certifi- 
cation and manufacturing process, deficiencies were overlooked and 
this new type of aircraft was pushed through the process in order 
to meet internal agency goals. 

As a result, the hearing today focuses on two central questions. 
One, did the FAA follow its regulations when certifying the Eclipse 
EA-500 and in the production of this aircraft? And two, was sarety 
compromised? The IG, Mr. Calvin Scovel, will provide testimony 
which details very serious issues with the FAA's certification and 
manufacturing of the Eclipse EA-500. 

One of the most disturbing findings to me in the IG's report is 
that instead of mandating that problems be resolved, the FAA ac- 
cepted lOUs from Eclipse to resolve the problems at a later date. 
In this case, an lOU was allowed on the avionics system that ran 
the plane. I question the practice of using lOUs in any instance. 
Flowever, to use an lOU on the avionics system that is used to run 
the EA-500, which I understand has no standby instruments or 
backup systems, from a new manufacturer, who has no prior expe- 
rience, and on a system so critical to the aircraft, is puzzling. 

Worse, according to the FAA's own testimony on pages 10 and 
11, Eclipse delivered 11 of their EA-500 aircraft to customers prior 
to the completion of the lOU on this critical avionics system. In an 
exchange of letters which I will submit for the record. Eclipse was 
to "retain control of the aircraft" until the issue was closed. Clearly, 
that didn't happen. 

The IG will also testify that 13 known deficiencies were unre- 
solved when the FAA approved the production certificate. This is 
unprecedented and a direct violation of regulations and yet, the 
FAA allowed it. Eclipse repeatedly demonstrated an inability to 
replicate its approved aircraft design on the production process and 
the FAA let them get by with it. 

Further, we will hear testimony to suggest that the FAA devel- 
oped an inappropriate relationship with Eclipse, forcing FAA em- 
ployees to expedite the Eclipse EA-500 aircraft through the certifi- 
cation and production approval process, even though serious con- 
cerns were raised. I have said time and again, safety cannot be 
compromised. In this case, the FAA is treating manufacturers like 
customers, instructing its employees to "build relationships with 
our customers" instead of acting as regulators. For example, the 
FAA's own test pilots said the EA-500 should not be certified as a 
single pilot plane because of in-flight concerns such as complexities 
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of the new software and a minimally effective autopilot system. 
And the FAA agreed. 

Eclipse filed a customer service complaint. The FAA and the 
agency immediately reversed course and certified the plane as a 
single pilot aircraft. In addition, the European Aviation Safety 
Agency refused to certify the EA-500 for operations. The FAA 
should be vigilant in ensuring the highest level of safety and be 
willing to slow down the certification process, and shut down pro- 
duction of such action as warranted to protect the flying public. 
Deadlines and goals should have been adjusted once deficiencies 
were found. 

Finally, we have seen a pattern at the FAA of an agency that is 
reactive, not proactive. Only after getting briefed by the IG on the 
Eclipse certification issue and on the IG's recommendation did the 
Acting Administrator convene a review team to do an audit of the 
certification programs. The FAA seems to be on autopilot until 
pushed into action, either by this Subcommittee, the IG or the 
news media. It is not enough to have safety regulations in place. 
The FAA must enforce those regulations. This Subcommittee has 
made safety a top priority and the FAA and manufacturers must 
do the same. We cannot have the agency responsible for aviation 
safety rely on the past or overlook problems by rushing certification 
in an effort to meet self-imposed goals. We expect, and we deserve 
more. 

With that, I want to welcome all of our witnesses here today and 
I look forward to hearing their testimony. Before I recognize the 
Ranking Member, Mr. Petri, for his opening statement, I ask unan- 
imous consent to allow two weeks for all Members to revise and ex- 
tend their remarks and to permit submission of additional state- 
ments and materials by Members and witnesses. Without objection, 
so ordered. 

The Chair at this time recognizes the distinguished Ranking 
Member, Mr. Petri, for his remarks or opening statement. 

Mr. Petri. Thank you very much, Mr. Chairman. Thank you for 
calling this important hearing on the certification of the Eclipse 
500 very light jet. 

If I may just comment on the question of safety, while expressing 
concern, always trying to do better, we should note that this is the 
era of maximum safety in commercial and general aviation in the 
history of the world, really, and certainly in the history of the 
United States. So it is a time to celebrate as well as to try to do 
better. I think we should put this whole subject in that context. 

If we were confronted with catastrophes resulting from poor de- 
sign and planes collapsing and people falling from the sky, that 
would be one thing. But the truth is, what we have been doing has 
been effective and American aviation is reasserting its leadership 
role in the world on many fronts. 

Perhaps because the Eclipse 500 is the first general aviation in- 
novation to be manufacture in the United States in a long time, 
and other planes like it, the very light jets have generated a lot of 
excitement in the aviation industry. They offer accessibility into 
the jet class for some, should make economically feasible new air 
taxi services to connect tertiary airports, making good use of excess 
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airport capacity and further expanding the connectivity of our na- 
tional aviation system. 

The Eclipse 500 is one model of a very light jet and it boasts a 
more fuel efficient design with the first integrated avionics system 
for this type of small jet aircraft. Because of these innovations, 
Eclipse garnered the attention of the media, industry, FAA and 
now us here in Congress. As we all know, aircraft certification is 
a very complex and difficult process, where deadlines and pressures 
are facts of life, much like the deadlines and pressures Members 
of Congress deal with when working on a reauthorization or appro- 
priation bill. 

Because very light jets are a new innovation and Eclipse in par- 
ticular incorporates cutting edge technology, the focus today should 
be on the FAA's certification methods and procedures. We must en- 
sure that the Federal aviation regulations are keeping up with in- 
novations in the industry. Innovation is at the heart of innovation. 
As the Wright brothers well understood, acceptable risk is a central 
part of discovery and development. As we strive to make aircraft 
more fuel efficient, cost efficient and more technologically ad- 
vanced, we must also maintain our historic safety record. Likewise, 
we must be careful not to erect unnecessary barriers to innovation. 

Minimum safety standards and alternative means of compliance 
provided for in Federal aviation regulations allow for innovative 
aircraft designs to be certified. The minimum safety standards pro- 
vide the benchmarks for manufacturers to design around and alter- 
native means of compliance allow the FAA and manufacturers to 
address an ever-evolving technological and manufacturing environ- 
ment. FAA's certification policies, widely recognized as the gold 
standard for safety worldwide, provide for appropriate safety over- 
sight where written regulations cannot keep up with technological 
innovation. 

Today the Department of Aviation Inspector General will testify 
about irregularities in the certification of the Eclipse plane. The In- 
spector General will also testify that he is not drawing any conclu- 
sion about the safety of the Eclipse aircraft. 

While it is important for this Committee to hear about certifi- 
cation irregularities and FAA's lessons learned analysis of the 
Eclipse certification process, we must be careful not to jump to any 
conclusions that these irregularities exist outside of this certifi- 
cation project. There is no evidence to suggest an industry-wide 
certification issue. In fact, the historic safety record stands to re- 
fute such a claim. 

The certification process in place today has contributed to the 
safest period in the history of manned flight. The safety record the 
system is enjoying today is the result of the hard work of many 
Government and industry partners and we must build on that suc- 
cess as we go forward. 

While the FAA must remain focused on its role as a regulator, 
we have to be careful not to turn the agency into a hammer looking 
for a nail. Much has been gained from the industry's willingness 
to share mistakes with the Government regulators, and that pro- 
fessional give and take must continue to exist to ensure our very 
safe system stays that way. 
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While it is possible that some of the Federal aviation regulations 
for aircraft certification may need to be reviewed, and perhaps al- 
tered to accommodate new kinds of aircraft technology, it is impor- 
tant to remember that the foundation of that certification, based on 
collaboration, coordination and information sharing, has proved 
successful and should not be changed or stifled. 

With that, I yield back. Thank you. 

Mr. Costello. The Chair thanks the Ranking Member and now 
recognizes the distinguished Chairman of the Full Committee, 
Chairman Oberstar. 

Mr. Oberstar. Thank you, Mr. Chairman. Thank you, and I 
want to thank our vigilant staff for doing superb work over many 
months on the issues that we will hear about today. Your con- 
stancy and oversight of safety in aviation is exemplary and I am 
delighted that you are taking up the challenge. 

Safety in aviation is always only one accident, one fatal accident 
away from unsafe. Vigilance and redundancy in every phase of 
aviation are vital to the essential element of safety. 

The issue here is not innovation versus safety, but the process 
by which we achieve safety, by which FAA carries out its responsi- 
bility, by which it establishes and sustains what I called years ago 
the gold standard in aviation safety worldwide. But as Chaucer 
wrote, if gold rusts, then what of iron? 

We are going to hear today how the FAA's customer service ini- 
tiative mistakenly treats those who are the subject of regulation as 
the customer of FAA. FAA has, if there is a customer, as we said 
in a previous hearing, it is the flying public. It is not the airlines. 
And in this case, it is not the manufacturer. I am very concerned. 
We have another example here that complacency has crept into the 
highest levels of FAA management, a pendulum swing away from 
rigorous enforcement of safety, rigorous enforcement of compliance 
to now a manufacturer. Previously we had an airline favorable, 
cozy relationship. 

There are significant risks posed by new aircraft and new tech- 
nology. The 777, which is designed entirely by computer and whose 
first article was put in place without doing a prototype, but with 
all the computer technology being right on, and the FAA was very 
concerned that this would, could result in some slippage, was on 
the scene day after day, watching over Boeing's technology when 
that first side of the hull was swung in place and came within a 
millimeter of exactitude. That is the kind of vigilance that we ex- 
pect of FAA and of the manufacturer, of Airbus, of Boeing, of 
Cessna, of all the others. In this case, the EA-500, with advanced 
avionics, turbine engine technology, characteristics more akin to 
large transport aircraft, it was incumbent upon FAA to establish 
a very high level of vigilance. 

And yet they had the audacity to put in their performance plan 
that the Eclipse would be certified by September 30th, 2006. The 
FAA shouldn't be setting a date by which it will compete a certifi- 
cation. The date by which you complete a certification is when it 
is ready, when it meets the standards, when FAA can say yes or 
no, not when the manufacturer wants it and not when some high- 
er-up in the agency says it should be done. 
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I reviewed the dcxuments and I leaked at the type certificate 
signing exactly on September 30th, 2006, a Saturday. The end of 
fiscal year 2006, coincidentally. How could FAA possibly know that 
the aircraft was going to be ready for certification at that point? 
I have never heard of the agency assigning itself a date by which 
an aircraft is to be ready for certification. 

The burden of when an aircraft is ready to be certified falls upon 
the manufacturer, not upon the professionals in the FAA. They 
have to meet the standards set by the FAA, not the other way 
around. FAA should respond in a timely fashion. They should not 
set up impossible paper trails, they should not set up red tape ob- 
stacles. But they should not sign off until the aircraft is ready, not 
until a date is met. 

Now, as I further looked at the documentation, I saw the FAA 
Rotorcraft Certification Directorate in Fort Worth, Texas, which 
had the primary responsibility for certifying the EA-500, was, in 
my judgment, very diligent in adhering to established regulations 
for certification. And they, at least on the face of it, seem to have 
performed very well. But their decisions and their recommenda- 
tions were routinely overruled by higher up FAA management, 
under the customer service rubric. 

So we are going to, in the course of this hearing, dig into the 
causes that led up to this system. The European Safety Agency has 
not signed off. And in May, when I addressed the ministers of 
transport of the European Union at their annual meeting, I was 
asked time and again, one after another, the 27 ministers, what is 
happening within your FAA? We are patterning our European 
Safety Agency after FAA, want to partner with FAA, we are now 
having second thoughts. They were aware of the Eclipse problem, 
they were aware of the customer service initiative. They were con- 
cerned, very deeply concerned. 

Let's not just take the attitude, well, we haven't had a fatal acci- 
dent. That is what in the past what was characterized as grave- 
yard mentality. FAA is above that and has to remain above that. 
The purpose of this hearing is to see that they do in the future. 

Thank you, Mr. Chairman. 

Mr. Costello. The Chair thanks you. Chairman Oberstar. 

The Chair announced that myself and Mr. Petri had an agree- 
ment that we would go directly to the first panel, but I would ask 
Members to keep in mind the number of witnesses that we have, 
and keep that in consideration and enter your statements into the 
record. However, Mr. Hayes has indicated that he would like to 
comment. So at this time, I will recognize my friend from North 
Carolina. 

Mr. Hayes. I thank the Chairman, and I appreciate what he is 
trying to do. Passion runs high on this subject. I am sitting down 
here listening, I am getting ready to hit the qect button. Because 
my take on this is almost 180 degrees out of phase with my Chair- 
man and my full Chairman. They are great people and I respect 
them tremendously. 

A couple of things. I am not a lawyer, but I heard a lawyer one 
time say, we are going to stipulate that safety is our primary con- 
cern. So let's write that on the wall and not refer back to it, be- 
cause everybody here is concerned about safety. No question. 
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The Government, Transportation, FAA has a function. It is to 
create an environment in which our citizens, our industry, our 
economy can function, under the safety banner at the highest pos- 
sible level. Folks, the future of the aerospace industry is to some 
degree, a great degree at risk and in play here. Staff has been vigi- 
lant. I agree, but the conclusions, and I don't know who they are 
that staff has reached, are simply wrong. The FAA is not perfect 
any more than this Committee, but they were diligent throughout 
this process. I am not here representing Eclipse, I am trying to rep- 
resent the American aerospace industry. We are in competition 
with the whole world for innovation. 

I have been flying for 40 years. Everything is different now. 
When I walk out the door every morning, should I have a rain coat, 
a top coat, a short sleeved shirt, we are talking, at the risk of over- 
simplification, in the same thing here. Mr. Scovel is going to bring 
us a report, and he is a very thorough, good guy. But the issue is, 
how do we keep the American aerospace industry and our economy 
moving forward with the new technology, which by the way, is cru- 
cial for American jobs in America, fuel efficiency, saving energy 
and everything else, how do we translate that into the traditional 
role of the FAA, putting the safest product on the market? 

I say to you, this Committee can do a tremendous amount of 
damage with our European counterparts by coming out here and 
saying the FAA is not doing their job. The folks who were in Fort 
Worth, they were doing their job. I am not questioning them. But 
when I got, and Leonard is with me, remember our conversation 
on the 430, Leonard? I got a GIOOO now. I had to get somebody 
to come in and help me, because I didn't understand all the new 
innovations of the technology that was available. 

Well, what does the technology do? It makes a cipher, it gives 
you situational awareness, does all kinds of things. But it does not 
take away the need to fly the airplane and the basics were there. 
This is a good, solid airplane that can fly and help America and 
move us in the right direction. 

So to say that it is not safe I think is incorrect. I have looked 
at it very closely. There are three systems, we talked a little bit 
about this, that back up everything. They are all electronic. That 
is okay. Mechanical is not needed, one, two, three, there has never 
been a failure. Thirty-two thousand hours now in service without 
a problem. Five thousand hours of flight testing, 32,000 hours in 
service? Folks, we need to really be careful what we are doing here. 

In 2001, the process started. In 2006, we certified it. That is not 
rushing. Flow do we get our job done and stay safe? Please, every- 
body, take a deep breath, realize what is at stake here and don't 
go down the wrong path of saying the FAA did it wrong. They 
didn't do it wrong. Did they do it perfect? No. We're not going to 
handle this hearing perfectly, but please focus on the fact that 
aerospace is important. We have a great system. I think it worked. 

I think there are issues that we can deal with, 13 deficiencies out 
of how many thousand? You can cover that, M r. Scovel. 

Mr. Chairman, thank you for indulging me. I have spent hours 
on this. I see it every day when I crank up. Thank you. Let's get 
her done. 
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Mr. Costello. I thank the gentleman for his comments. Let me, 
if I can, comment, because you and I have had conversations yes- 
terday, and we have been talking about this subject. Is the purpose 
of the hearing to find out, one, did the FAA follow the regulations 
when certifying the EA-500, and two, throughout the whole produc- 
tion and the process? I think we are going to hear testimony today, 
at least testimony that I have read from the I nspector General and 
from other witnesses here that brings those questions into play. 

Secondly, I spent, not to get off on another subject, I am trying 
to get to Members too, so we can go to our witnesses, this past Sat- 
urday I spent half my day, four hours, with my senior Senator and 
my colleague j ohn Shimkus in Marion, Illinois, in a VA hospital in 
my Congressional district, where employees two to three years ago 
complained to the administrator at the facility that there were 
things going on at the hospital that just didn't seem right. Deaths 
were occurring. 

Long story short, because of oversight, because Congress stepped 
in and insisted that the Inspector General come in, it was deter- 
mined that nine people died in that facility as a result of sub- 
standard care. 

Why do I bring that up? Our responsibility is to ask the tough 
questions. And I certainly understand that there is a balance you 
have to consider. The industry, you have to consider a number of 
factors. But our responsibility is to do a number of things. One of 
those things is oversight, and to ask the tough questions. That is 
why we are here today. 

If the administrator at the hospital in Marion would have lis- 
tened to the employees who were complaining to him two and a 
half or three years ago, peoples' lives may have been saved. But he 
didn't listen. He said, we know how to handle it, we are handling 
it perfectly, until others stepped in, the Inspector General and oth- 
ers got involved. It is documented now, nine people died because 
of substandard care on the part of one surgeon and some others in- 
volved. 

So I feel very strongly, you have heard me say it many times, 
that we have a responsibility to provide oversight. That is exactly 
what we are doing today. We are looking for the facts, we are look- 
ing to find out what was done right, what was done wrong, and if 
we can improve upon this in the future. 

With that 

Mr. Oberstar. Would the gentleman yield? 

Mr. Costello. I would be happy to yield to Chairman Oberstar. 

Mr. Oberstar. I respect the gentleman from North Carolina, he 
is a long-time aviator, with his heart in the right place. But he 
would not be flying safely if FAA had not done its vigilance in 
years past. Our purpose here is to find out what they slipped up 
on, where did they come up short, and be sure that they fix it for 
the future. That is the purpose of this hearing. If you listen to the 
facts and read the record, you will see that there are shortcomings 
that are system shortcomings that we have to assure that FAA 
fixes for the future. That is the purpose of this hearing. 

It is not to condemn any aircraft, any manufacturer, it is to find 
out how FAA has come up short and how we can fix things for the 
future. 
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Mr. Hayes. Would the gentleman yield? I agree with you. I agree 
with you. My real concern was the way the issue was framed ini- 
tially, the FAA is not wrong, the folks in Fort Worth weren't 
wrong. Eclipse wasn't wrong, but we can do it better and you are 
absolutely right, it is what we are here for. 

Mr. Costello. I appreciate the gentleman's comments. I don't 
agree with you that the FAA was not wrong, I think that they were 
wrong, and I think that some testimony here will document that, 
but that is the reason we are here, is to find that out. 

We have a vote going on on the Floor, but before we do, I am 
going to recognize the final Member of the Subcommittee. We will 
then go to the Floor. We have, I understand, one vote, and then 
will not be interrupted for some time. We have three votes now I 
am told, but I am also told that we will not have votes for a few 
hours. But you never know around here. 

With that, I will recognize the gentleman from Iowa, Mr. Bos- 
well. 

Mr. Boswell. Thank you, Mr. Chairman. I will be short. 

I champion what you are doing and what Mr. Oberstar is doing 
in regard to oversight. I think we have not done as well as we 
could have done. I know, as I know the two of you, we are going 
to do better. 

At the same time, I feel, because I have cracked the throttle, as 
some of the rest of you in the room, on some pretty new stuff, fixed 
wing and rotor and so on. I had a lot of confidence that the checks 
were made. For example, Mohawk, Caribou and a couple of dif- 
ferent helicopter series. 

So anyway, I think somebody said, I don't know who said it in 
the earlier remarks, that around the world, we do have the gold 
standard. Now, that doesn't mean we can't make mistakes. I think 
the fact that we take the opportunity to review and do oversight 
is good. I also want us to remember that, as I think in terms, and 
I make no bones about it, I am an advocate for general aviation, 
and I want us to be very careful, and I will try to be hereto remind 
us of that, that we do appreciate that we have done pretty darned 
good. But that doesn't mean we shouldn't check. I think that is 
what I heard from you, Mr. Chairman, and no one will ever object 
to that. 

But I don't want us to think that we haven't had, through, many, 
many, we all know that a few years ago we just about did away 
with the prop-driven airplane because of, I don't know, I call them 
frivolous lawsuits in some cases. I don't want us to go back and get 
into something like that. I think it is a big industry in our econ- 
omy, we are selling around the world. And people around the world 
that I still have some contact with have a great respect for the way 
we go about it. 

But if we can make it better, there is nothing wrong with that. 
And I do champion and I do appreciate the fact that we are willing 
to do oversight and ask the hard questions. But we have had a 
pretty good thing going and the record stands behind it. I just want 
us to keep that in mind. 

Thank you for giving me this opportunity. I will stop. I have 
more to say but I will stop there. Thank you. 
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Mr. Costello. The Chair thanks the gentleman, and we will an- 
nounce that the Subcommittee will stand in recess. We will return. 
We would ask everyone in the room to return by 11:00 o'clock, 25 
minutes from now. When we return, we will go directly to our first 
panel, to the Inspector General, Mr. ScoveT. The Subcommittee 
stands in recess. 

[Recess.] 

Mr. Costello. The Subcommittee will come to order. 

The Chair now recognizes our first witness, the Honorable In- 
spector General of the Department of Transportation, at this time 
you are recognized. General Scovel. 

TESTIMONY OF THE HONORABLE CALVIN L. SCOVEL, III, IN- 
SPECTOR GENERAL, UNITED STATES DEPARTMENT OF 

TRANSPORTATION 

Mr. Scovel. Thank you, Mr. Chairman. With your permission, I 
would like to take about ten minutes for my oral statement. 

Mr. Costello. No problem. 

Mr. Scovel. Thank you, sir. 

Mr. Chairman, Ranking Member Petri and Members of the Sub- 
committee, we appreciate the opportunity to testify today regarding 
FAA's certification of the Eclipse EA-500 Very Light J et. Over the 
past several years, multiple manufacturers have designed a new 
class of aircraft called Very Light J ets, or VLJ s. VLJ s are small 
aircraft with advanced technologies that cost less than other busi- 
ness jets but operate at similar speed and altitude. In 2006, FAA 
certified the first VLJ s, one of which was the Eclipse EA-500, a six- 
seat jet aircraft that featured advanced avionics and better fuel ef- 
ficiency. 

Mr. Chairman, I would like to take a moment and establish from 
the outset what this case is about and what it isn't about. First, 
it isn't about an unsafe aircraft that must be grounded imme- 
diately. This case isn't about a certification process that is riddled 
with flaws and must be revamped from A to Z. My office has not 
examined the certification process at large. 

This case isn't about the longstanding practice of FAA to recog- 
nize alternative means of compliance and equivalent levels of safe- 
ty, a practice that is generally sound and makes sense. This case 
isn't about an FAA field office run amok. While their bedside man- 
ner in dealing with the manufacturer could have been better, local 
FAA officials acquitted themselves well and honorably in making 
difficult technical and safety- related decisions. 

What this case is about is a strikingly accommodative approach 
to an effort by a new, untested manufacturer using new technology 
and a new business model to put a high-speed, high-altitude jet in 
the hands of relatively inexperienced private pilots. This case is 
also about an intensely calendar-driven, not event-driven, effort to 
certify an aircraft by a date that was selected a year before. 

It is also about a certification process that has a long history of 
success involving FAA and the industry, but in this case was re- 
moved from local officials and controlled, indeed driven by, officials 
in FAA headquarters. Finally, this case does raise questions about 
whether FAA focused exclusively on safety as its highest priority, 
as mandated by law. 
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We now turn to the specifics of our investigation. I n March 2007, 
we received FAA inspector complaints that the Eclipse jet was 
pushed through the certification process too quickly. A significant 
issue overshadowing FAA's certification of the EA-500 is that with 
the inherent risks associated with a new aircraft utilizing new 
technology, produced by a new manufacturer, and marketed with 
a new business model, FAA should reasonably have been expected 
to exercise heightened scrutiny in certifying this aircraft. 

In addition, because the EA-500 has advanced avionics and tur- 
bine engine technology typical of large transport aircraft but also 
is light m weight like smaller private aircraft, it did not fit easily 
into FAA's existing certification framework. FAA chose to certify 
the EA-500 and other VLJ s using certification requirements for 
general aviation aircraft, rather than the more rigorous certifi- 
cation requirements for larger transport aircraft. 

Flowever, in a post-design certification lessons-learned, internal 
review of the Eclipse project, which is included in our handout, 
FAA managers acknowledged at page eight that the general avia- 
tion certification requirements were "inadequate to address the ad- 
vanced concepts introduced on this aircraft." 

In certifying the EA-500, FAA asserts that it met all pertinent 
certification regulations. Flowever, the results of our investigation 
to date show a combination of actions and inactions on the part of 
FAA indicating that it expedited the certification processes for the 
Eclipse EA-500. First, during the design certification of the EA-500, 
Eclipse applied for and FAA approved alternative means of compli- 
ance for the aircraft's avionics software and airspeed and altitude 
indicators. 

While FAA guidance concerning this process allows for deviation 
from normal accepted practices, we are concerned about the level 
of review that FAA conducted in certifying the software. For exam- 
ple, FAA did not require the software to be approved to the accept- 
ed industry standard before certification. Instead, FAA accepted an 
lOU from Eclipse that stated the aircraft would meet the accepted 
industry standard at a later date. Flowever, when FAA issued the 
design certificate. Eclipse's software supplier had only completed 
23 of the 65 required tests. 

The supplier subsequently completed all 65 tests by j une 2007. 
Flowever, EA-500 users continued to report problems with cockpit 
instrumentation as recently as May 2008. 

A J une 2008, incident involving the EA-500 heightened attention 
regarding the aircraft's design certification. The incident involved 
an EA-500 that was on approach to Chicago Midway Airport when 
it experienced throttle failure. After consulting the emergency pro- 
cedures, the pilot shut down one of the engines. Flowever, this ac- 
tion caused the second engine to roll back to idle power and be un- 
responsive to the throttle. The two pilots declared an emergency 
and were able to land the plane without injury to themselves or 
their two passengers. 

During its investigation into the incident, NTSB expressed con- 
cern about the reliability of an assembly that failed after accumu- 
lating only 238 hours and 192 cycles. NTSB also raised concerns 
that the problem could be due to flaws in the design logic for the 
software that controls the engines. As a result of this incident, FAA 
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engineers reexamined the software that controls the engines and 
discovered software logic flaws that should have been resolved be- 
fore design certification. 

At the end of J une 2008, the local FAA certification manager 
sent a memorandum to the manufacturer requiring Eclipse to de- 
velop an approach to bring the aircraft design into compliance for 
that system. Eclipse is currently addressing FAA's requirement. 

Second, FAA awarded Eclipse a production certification, even 
though the Agency knew of deficiencies in the company's supplier 
and quality control systems. To receive a production certificate, 
manufacturers are required to undergo FAA quality control reviews 
and an FAA production certification award review to determine if 
they have complied with all regulations. FAA's quality control re- 
views, which began in J uly 2006, identified numerous deficiencies, 
with 42 serious deficiencies identified as late as February 2007. 

The production certification board completed its review on April 
2007, the same day the production certificate was granted, and 
identified two serious overarching deficiencies relating to Eclipse's 
supplier and quality control systems. Despite the impact these 
issues could have on the production process, FAA awarded the pro- 
duction certification to Eclipse with 13 known production problems. 

Further, even after granting the production certificate, FAA au- 
dits of Eclipse supplier controls found significant deficiencies. In 
seven out of seven Eclipse suppliers audited, FAA investigators 
identified serious non-conformities involving issues such as non- 
conforming parts, uncalibrated tools, and supplier personnel using 
outdated manufacturing specifications. At the largest user of the 
EA-500, for example, mechanics found problems with Eclipse sup- 
plier-manufactured parts on 26 of the 28 EA-500 aircraft operate 
by that company. 

Finally, results of our investigation indicate that FAA's desire to 
promote the use of VLJ s may have contributed to its decision to ac- 
celerate the Eclipse certification process. A significant concern sur- 
rounding this issue, Mr. Chairman, is that FAA specifically des- 
ignated the Eclipse VLJ as a priority project for certification. I n its 
fiscal year 2006 performance plan, FAA's aircraft certification serv- 
ice identified Eclipse as a priority, stating flatly that it would cer- 
tify an Eclipse small jet by September 2006. Our handout includes 
a copy of the cover sheets of those performance plans. 

Although FAA met this deadline, this specific designation as a 
priority certification may have resulted in reduced vigilance on the 
Agency's part during the aircraft's design and production certifi- 
cation processes. We identified four other FAA actions that raise 
concern regarding the Agency's safety oversight focus in this mat- 
ter. First, FAA granted Eclipse authority to certify its own aircraft 
for airworthiness far earlier than other new VLS manufacturers, 
specifically, 4 years before Eclipse obtained a design certificate for 
its aircraft. Flowever, it is not clear why FAA determined that 
Eclipse met the qualifications to perform its own inspections, since 
Eclipse was a new manufacturer with no history of manufacturing 
an aircraft or shepherding a design through the design certification 
process. 

In one instance. Eclipse presented an aircraft to FAA for air- 
worthiness certification with approximately 20 airworthiness defi- 
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ciencies, even though an FAA-approved company inspector had pre- 
viously inspected the aircraft for airworthiness and found no non- 
conformities. Second, in response to a customer service complaint 
launched by Eclipse, FAA granted single-pilot operation certifi- 
cation for the EA-500 despite FAA Flight Standardization Board 
concerns. 

Third, FAA replaced the inspection team overseeing Eclipse and 
restrict^ the new team's inspection activities. In a six-page letter 
of reprimand, FAA officials stated that the manager failed to meet 
expectations associated with meeting its customer service initia- 
tives. Fourth, a former FAA engineer assigned to the Eclipse 
project took a position as director of certification for Eclipse imme- 
diately after leaving FAA without a cooling-off period. 

Mr. Chairman, at our recommendation, FAA established a spe- 
cial certification review team last month. The team completed its 
assessment last week and concluded that the design certification of 
the Eclipse was appropriate because it met FAA requirements for 
the focus areas reviewed. We received a copy of the team's report 
on Saturday and are reviewing its findings and recommendations. 

Flowever, based on the interim results of our own investigation, 
in which we have been assisted by independent contract aviation 
safety experts, we recommend that FAA take several immediate ac- 
tions. Those include, one, verify that certification of the EA-500 for 
single-pilot use was appropriate; two, expedite its proposed rule- 
making to clarify certification requirements for the expanding VLJ 
industry segment; and three, evaluate the propriety of granting 
new, inexperience manufacturers authority to certify the air- 
worthiness of their own aircraft prior to design certification. 

That concludes my testimony, Mr. Chairman. I would now be 
happy to answer any questions you or other Members of the Sub- 
committee may have. 

Mr. Costello. Thank you, Mr. Scovel. I have a number of ques- 
tions. On I think it is page 21 or 22 of your testimony, you indicate, 
actually page 20, the FAA granted Eclipse authority to certify its 
aircraft for airworthiness before proving the design far earlier than 
it has for other VLJ manufacturers. Then you state at the bottom 
of page 20, "Eclipse is the only operating VLJ manufacturer to re- 
ceive its ODAR authorization before the aircraft design was ap- 
proved by the FAA." 

First, for the benefit of the record and those here, explain what 
the ODAR gives the authority of a manufacturer to do, and then 
I will have another question. 

Mr. Scovel. Yes, sir, thank you, Mr. Chairman. 

ODAR stands for Organizational Designated Airworthiness Rep- 
resentative. It is a system employed by the FAA as part of its over- 
all designee program, which enables it to maximize its own re- 
sources, by tapping into expertise in the industry, residing either 
at manufacturing or at maintenance organizations. A manufac- 
turing organization must show that specific individuals in its em- 
ploy have the experience and expertise to inspect aircraft owned, 
repaired, or being manufactured by the organization to FAA's re- 
quirements. FAA will then grant that company an ODAR designa- 
tion. The designated employees remain on the company's payroll. 
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but are in a special status, almost as a deputy for FAA's purposes 
in this regard. 

Mr. Costello. And the ODAR was issued on, according to the 
chart on page 21, on September 3rd, 2002. The design certificate 
was not issued until September 30th, 2006, is that correct? 

Mr. ScovEL. That is correct, sir. For the record, I want to make 
clear that our statement at the bottom of page 20, where we say 
Eclipse is the only operating manufacturer to receive its ODAR au- 
thorization before the aircraft design was approved, we are refer- 
ring specifically to the VLJ manufacturers in table 3 at the top of 
page 21. 

Mr. Costello. As a new manufacturer, do you think that Eclipse 
could have possibly demonstrated this level of expertise to receive 
that designation four years prior to the design certification? 

Mr. ScovEL. I n the experience of my staff and the aviation safety 
experts we are relying on, sir, it would be very difficult. Eclipse 
was founded in 1998. This particular aircraft that they were ad- 
vancing at the time was their first production effort. For a brand 
new company like that to stand up, to find the expertise, to hire 
those employees, and then to successfully present that case to FAA 
would have been difficult, sir. 

Mr. Costello. So you question the certification of ODAR in this 
circumstance, is that correct? 

Mr. ScovEL. In this circumstance, and I do want to make that 
clear. My office has been familiar for a long time with the designee 
program, the ODAR practice specifically. Our questions concern 
how it was applied in this case. 

Mr. Costello. Another question concerning the lOUs. In other 
words, for the FAA to tell Eclipse that instead of meeting a par- 
ticular standard for certification or satisfying a concern or a defi- 
ciency that you can just get back with us at a later date and tell 
us that this is addressed. I would like you to comment on the 
lOUs, because I know they have been used in the past. Is it com- 
monplace in the certification program, and in this case, do you 
think it was appropriate? 

Mr. ScovEL. lOUs are used by FAA, as you mentioned, sir. The 
requirement to meet FAA certification standards can be met flat- 
out by an applicant. FAA also has authority under its r^ulations 
to grant a waiver from certain requirements, if the applicant can 
show that those requirements will not apply specifically to the air- 
craft held out for certification. An applicant can also request an 
equivalent level of safety finding, which is, simply put, an effort by 
an applicant to show FAA that is has another way to skin the cat. 
In other words, there may have been a generally prevalent method 
in the industry for applicants to satisfy specific technical require- 
ments — but this particular applicant may have another way. 

In addition, a more informal practice has been the lOUs. It is not 
unusual for them to be grant^. In our review here, both Boeing 
and Si no Swearingen have been afforded lOUs, but customarily, 
th^ are for non safety-related pieces of the airplane. This case, 
which involved the avionics software with a new model of aircraft 
that relies exclusively on the avionics for safe operation, calls into 
question the practice of an I OU . 
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Mr. Costello. Does it disturb you, as I mentioned in my opening 
statement, the fact that the manufacturer. Eclipse in this case, was 
granted the authority to deliver 11 of the EA-500s to their cus- 
tomers before deficiencies were addressed and lOUs were given on 
those deficiencies, is that standard practice? 

Mr. ScovEL. It is not standard practice. That is frankly alarming 
to me, sir. Particularly since it appears that FAA attempted to 
limit the distribution of aircraft that may have been held subject 
to the lOU, that may have been a reasonable restriction at the 
time. However, it appears the company went beyond that. 

Mr. Costello. And they in fact did not retain control over those 
11 aircraft. They in fact delivered them to customers. 

Mr. ScovEL. Yes, sir. My office is working to verify that informa- 
tion. 

Mr. Costello. With deficiencies remaining? 

Mr. ScovEL. Yes. 

Mr. Costello. You heard Chairman Oberstar comment on the 
control of the aircraft as certified, almost exclusively in the control 
of the manufacturer, not the FAA. Would you say that it is highly 
unusual for the FAA to say internally, we are going to certify this 
aircraft by September 30th of 2006, or a specific date, driven by, 
internally within the FAA as opposed to the manufacturer? 

Mr. ScovEL. It is unusual, and in this particular case, sir, it gave 
rise to our characterization of this certification process as a cal- 
endar-driven rather than an event-driven process. In our handout, 
which was made available to all the Members, there are copies of 
the pertinent pages from the business plans of the different FAA 
entities. The Members can follow the progression from an appro- 
priately high-level statement of an initiative at the FAA Head- 
quarters level through the aviation safety business plan, which 
states simply as a target to issue a type certificate for a new model 
aircraft by September 2006, and that characterization as a target 
may be appropriate. 

However, by the time you get to the bottom of the page, and here 
we are talking about the aircraft certification service performance 
plan, there was a specific reference, not only to issuing a type cer- 
tification by September 2006, but a specific statement that Eclipse 
Aviation will obtain type certification for a small jet powered by a 
Pratt and Whitney 610 engine and using extensive new technology 
avionics. It appears to us, sir, to indicate a predetermined outcome. 
This performance plan would have been drafted a year in advance, 
because it would have been published at the beginning of the fiscal 
year. It looks I ike a self-fulfilling prophecy, sir. 

When our dedicated FAA employees read that, they know what 
their marching orders are, sir. 

Mr. Costello. So it was clear to you that they knew the certifi- 
cation date and they had to meet it? 

Mr. ScovEL. Yes. It is a statement of the priority on which man- 
agement attached this particular project. It appears to be, as I 
mentioned, a self-fulfilling prophecy. Certainly, while dedicated, 
ethical employees would have raised objections, I am sure, it be- 
comes a goal and something that people are going to work very, 
very hard for. That was clearly the case here. 
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Mr. Costello. Two final questions and then we will have an op- 
portunity to come back. You mentioned that you have had a chance 
to review the FAA's special certification review team's report. You 
mentioned some of your views of that report. Can you elaborate for 
us? 

Mr. ScovEL. Yes, sir. I mentioned that we had received the SCR 
report, the special certification report, over the weekend. We are 
currently reviewing it. We will be following up this testimony with 
a full audit report that we will discuss the SCR report in more de- 
tail. 

Let me pick up on what I started my oral statement with, about 
what it is and what it isn't. Here is our initial take on the SCR 
report. It is a commendable response by the FAA to my agency's 
strong recommendation in J uly that it undertake a special review 
of the Eclipse certification. 

The report is a comprehensive examination by a well-regarded 
team of aviation safety experts of several narrowly focused, highly 
technical questions that appear to be left open in the rush to issue 
a type certification, and I do emphasize type certification here, to 
Eclipse not later than September 30th, 2006. 

It appears to us, however, that this report is not, we know it is 
not, the last word. We know that this Committee will continue its 
work, as will my office. We also know that this r^ort is not a re- 
view of the process leading up to the decision to issue the produc- 
tion certificate. It was limits to the type certification only, and 
that is a good thing, because the SCR's objectivity on the produc- 
tion certification point could fairly be questioned. Mr. Ron Wqjnar, 
who headed the final production certificate surge in March and 
April 2007 also served as a member of the SCR team. 

Our testimony also makes clear that the PC decision itself is dif- 
ficult to defend or explain. For the record, sir, I would like to say 
that I had a conversation this morning with Mr. Sturgell, the Act- 
ing Administrator of FAA. He indicate to me that in the near fu- 
ture, the Agency intends to mount a review effort that is similar 
to this SCR but focused on the production certification side. 

One final remark, sir. The necessity for this review and its find- 
ings confirm for us that a "better late than never," or a "fill in the 
blanks later" process was employed, first to make the decision to 
issue the type certificate and then to shore it up after FAA's staff, 
with inside knowledge of the case, lodged complaints with my office 
and with this Committee. It is an outstanding report, but it should 
not be used as an ex post facto justification for the decision to issue 
the type certificate. 

Mr. Costello. Thank you, Mr. Scovel. 

The Chair now recognizes the Ranking Member, Mr. Petri. 

Mr. Petri. Thank you very much. I am approaching this as a lay- 
man. I am not, like Mr. Hayes and some other colleagues, a li- 
censed pilot. I use the services frequently, to keep this in context. 

Our Chairman took us to Everett, Washin^on a couple of 
months ago and we got to see the new Dreamliner, which has a lot 
of new technology. It is a whole new step in aviation, the first time 
a plane will be able to fly non-stop from London to Sydney, Aus- 
tralia and so on and so forth. The people who are building it said 
this is 50 year old technology, it is B1 bomber technology now get- 
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ting its civilian iteration. There have been a lot of changes in mili- 
tary stuff in 50 years, so we will see an avalanche of new tech- 
nology coming through to get the certification process going for- 
ward. 

How long did this certification take from beginning to end, do 
you know? 

Mr. ScovEL. About 5 years, Mr. Petri. It began in 2001, as I un- 
derstand it. It proceeded through, well, type certification Sep- 
tember 2006, with ultimate production certification on April 26, 
2007. So, about 5 and a half, to 6 years. 

Mr. Petri. If they hadn't done things like, I guess they call these 
lOUs or other ways of trying to do concurrent review, do you have 
any idea how long it would have taken if they had done it sequen- 
tially? 

Mr. ScovEL. Hard to say, and I don't want to speculate. I can 
say that with the grant of type certification in September 2006 and 
the lOU specifically on the avionics software question, that avionics 
software question was not fully closed out using the accepted in- 
dustry standard until J une 2007. So it is safe to say that perhaps 
it would have been at least J une 2007, and, if FAA had identified 
other items that required further work, it might have been longer 
than that. 

Mr. Petri. Is any of this driven by personnel issues in the sense 
that they have a lot more new technology? We had 40 or 50 years 
because of liability issues and this sort of thing, when there was 
not that much real new innovation, new models, airplanes were not 
being domestically manufactured in the United States because of, 

I guess the liability crisis? Now we have solved that. Do you have 
any impression as to whether they could be overtaxed, or we should 
be doing more contracting out or trying to get more technical exper- 
tise into the certification process based on this particular thing? Or 
is everyone up to the job? 

I get some since that people are used to doing it the old way, a 
little slower pace, comfortable technolpgy. Now a lot of things are 
new, and I am not going to approve it until I understand it and 
I don't understand it and maybe some things I will never under- 
stand and yet the world goes on. We can't really demand that the 
world revolve around Government inspectors. We have to figure out 
some way of striking a balance and allowing technology to go for- 
ward, or the world will go forward without us. 

Mr. ScovEL. Most certainly, Mr. Petri, I couldn't agree with you 
more. FAA has known for some time that VLJ s were on the way. 
In this case, again, focusing on this case and noting clearly for the 
record, I hope, that my office has not undertaken any review of the 
certification process at large, it appears to us to have been working 
well for FAA and the industry. However, in looking at this case, 
we can say that FAA was somewhat off the mark in, well, frankly, 
it should have developed certification standards in advance of the 
advent of VLJ 's, so that it would have been prepared to inspect 
VLJ s against the proper standard. 

That is one of the observations of FAA itself in the lessons- 
learned slide presentation, the Power Point presentation that I pro- 
vided to each Member. At page 8, under observations, and this was 
a lessons learned meeting that was convened in November 2006, 
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FAA acknowledges that Part 23 regulations, those are the general 
aviation certification regulations, are inadequate to address the ad- 
vanced concepts introduced on this aircraft. The special certifi- 
cation review that concluded last week also stated that Part 23 reg- 
ulations were "not valid" for use in certifying VLJ s. 

That is certainly one aspect of FAA operations that needs atten- 
tion. Thankfully, the Agency itself recognizes that, and in our testi- 
mony we have urged the Agency to move as quickly as it can on 
this score. 

Mr. Petri. One last quick question. When do you expect your 
final report? We have heard about deadlines and things. Flave you 
set yourself a deadline for the report? Or would that be improper? 

Mr. ScovEL. I have to be careful with deadlines, sir, especially 
in this setting. We are proceeding as fast as we can, and I regret 
that I can't give you a date certain at this point. If I can get back 
to you, sir, as soon as we have a firmer picture, I would be happy 
to. 

Mr. Petri. Thank you. 

Mr. ScovEL. You are welcome, sir. 

Mr. Costello. The Chair thanks the Ranking Member and now 
recognizes the distinguished Chairman of the Full Committee, 
Chairman Oberstar. 

Mr. Oberstar. Thank you, Mr. Chairman. 

Mr. Scovel, you have done a superb service to aviation with your 
report, your inquiry, the issues you have raised, the lessons learned 
that you have compiled and observations in the document you sub- 
mitted to the Committee. When I look over the categories, if you 
will, avionics software issues, airspeed and altitude indicator prob- 
lems, the pitot static systems problems, intermittent erroneous 
stall warnings, cockpit display failures, flap movement failures, 
service difficulty reports, there is a compendium of problems with 
this aircraft and with FAA's oversight of this aircraft. Didn't that 
trouble you as you went through, reviewed their process? 

Mr. Scovel. It does trouble me, sir, and I would like to put that 
in context. I am looking specifically at the decision of FAA to grant 
type certification on September 30, 2006. At that time, it was clear 
that the avionics software didn't measure up. FAA chose to deal 
with it with an lOU. 

Regarding the pitot static system, which indicates airspeed and 
altitude and rate of climb information to the pilot, that was han- 
dled through an equivalent level of safety finding. It is noted in our 
testimony, and you may hear about it from witnesses in subsequent 
panels, that the equivalent level of safety finding was first re- 
quested of the certification office immediately responsible for the 
Eclipse project. The inspectors declined, based on their technical 
expertise, to grant the equivalent level of safety finding. It was 
then referred to another certification office. They did a review and 
determined that they could satisfy it. But, there was at least one 
office that hadn't made this determination. 

Regarding the other problems that you mentioned, sir, those 
should have been squarely in FAA's sights at the time. Because 
those had been highlighted during the function and reliability 
flight testing that was conducted over a span of about 2 weeks im- 
mediately before the September 30, 2006 decision. 
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I n talking with my staff, I heard the well-known phrase, and you 
all remember it on this Committee, "what did they know and when 
did they know it?" Here, we are talking about FAA. What did FAA 
know and when did they know it? At September 30, 2006, they 
knew a lot. It strikes us, and it struck our contract safety experts, 
who are independent experts that a reasonable decision on Sep- 
tember 30, 2006 might have been to defer the granting of the type 
certificate. 

Mr. Oberstar. That is what occurred to me when I read through 
the documentation. I know I discussed the matter with Chairman 
Costello, whose career before Congress included long-time service 
as a police investigator, with fine attention to detail. I have not 
known of any certification process in which FAA issued an lOU 
and then said, you are certified but you can come back and fix this 
later. They always insisted on fixing first what needs to be fixed. 
Are you aware of any other case like that? 

Mr. ScovEL. I cannot answer that question, sir. We haven't ex- 
amined other certification processes, individual cases, or the certifi- 
cation process at large. So I really have no basis on which to an- 
swer, sir. 

Mr. Oberstar. One of the issues is that the test pilots at FAA 
were opposed to approving the aircraft for single pilot operation. 
Yet the FAA overruled their own pilots. What was their justifica- 
tion for overruling the pilots? 

Mr. ScovEL. This is an area that we intend to follow up on as 
we proceed with our advanced audit work. Because at this point, 
there certainly appears to have been a controversy. 

Let me run through the chronology. It is clear that the company 
wanted single-pilot designation, so as to market to individual buy- 
ers. This was part of the business model. 

The FAA's Flight Standardization Board pilots had concerns 
based on their test flights and determined that the aircraft that 
they were flying would have presented an undue burden on one 
pilot. Some of those concerns were cockpit displays freezing up, dis- 
crepancies with the airspeed and altitude indicators, and a mini- 
mally effective autopilot system. It has been pointed out to us that 
the aircraft that Eclipse offered to the FAA test pilots was "a non- 
conforming aircraft." We need to run that to ground, frankly. It is 
puzzling why the company whose business model depends greatly 
on single-pilot operations would make a non-conforming aircraft 
available to FAA for this critical test pilot run. We would Tike more 
detail on that. 

I n any event, however, at the conclusion of its testing, on Decem- 
ber 13, 2006, the Flight Standardization Board recommended a 
two-pilot crew. On December 15, 2006, the Chief Executive Officer 
of Eclipse initiated a customer service complaint. On December 21, 
the Director of the Flight Standards Service issued a letter back to 
Mr. Raburn, President and CEO of Eclipse, in which, and I apolo- 
gize, if I may read into the record segments of the letter, and I can 
provide the complete letter for the record. 

"Mr. Raburn, thank you for your letter dated December 15th. 
Specifically, Eclipse took exception to the FSB's preliminary deter- 
mination that the Eclipse 500 required a two-pilot crew to operate 
safely. In an effort to be responsive to your concerns, a teleconfer- 
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ence tcxDk place on December 18th between FAA and your staff. Ad- 
dressing your main point of concern, I agree with the assertion 
made by Eclipse that the 500, as evaluated by the Aircraft Certifi- 
cation Service, is certificated as a single-pilot IFR airplane. Flight 
Standards," and this is a separate office within FAA, "Flight Stand- 
ards asserts that the proposed Eclipse aviation training program, 
as reviewed by the Flight Standardization Board is inadequate in 
preparing an applicant to pass a single-pilot type certification 
check. The FAA would like to work with Eclipse to determine the 
proper level of training, checking and currency requirements need- 
ed to support safe single-pilot operations in the 500. I am con- 
fident," and I am jumping to a couple other sentences toward the 
bottom of the letter, "I am confident that both FAA and Eclipse will 
be positioned to complete the 500 certification process. I want to as- 
sure you that Flight Standards will do everything possible to work 
with Eclipse Aviation in assuring a successful conclusion to our ef- 
forts." 

There is no mention of type non-conformity as one might expect 
in such a letter, if that were a fundamental source of disagreement 
between FAA and the applicant. We promise we will run that fur- 
ther to the ground. But it is clear, too, that what the company had 
done was come back to FAA strongly urging that this was a train- 
ing program rather than a hardware program that a single pilot 
would find difficult to operate. And FAA was attempting to work 
that out. 

The ultimate result was J anuary 27, 2007, after further work by 
the Flight Standardization Board, the two-pilot recommendation 
was set aside and the Eclipse was certified for single pilot. 

Mr. Oberstar. If that had been the case in the incident that you 
describe in your testimony that we discovered in our inquiry into 
this matter of the aircraft up at 41,000 feet, and trying to power 
down there and it didn't work, at that point, isn't a two-pilot situa- 
tion safer? 

Mr. ScovEL. It strikes me that it would be. I will defer to the 
NTSB expert who will follow on a panel after me. The NTSB, of 
course, specifically investigated the incident over Midway. It is 
clear that having two pilots in that aircraft, and that aircraft was 
at the time being operated by two pilots, was instrumental to the 
safe outcome of that event. Also, the incident occurred over an air- 
port, and they had some lucky breaks on that one, so it worked 
well. 

The pilots on my own staff, if I may take just a moment, sir, on 
this two-pilot question, to point out — and they are recreational, 
kind of weekend warrior type pilots — if they were well-off enough 
to buy a VLj and found themselves in an Eclipse 500, at night, at 
altitude, heavy weather, alone, and a cockpit display screen 
blanked out, they look to the other cockpit display screens, observe 
that altitude data differed between those two airscreens — and those 
are problems that had been identified with the avionics long be- 
fore — they would consider themselves in a fine fix. 

Mr. Oberstar. Well, safety in aviation should not depend on 
lucky breaks. And the expression, as we heard earlier, oh, FAA has 
done everything by the book, they haven't. They clearly haven't. 
They have made some major mistakes on this process. 



21 


One last one, for the moment, at any rate. FAA uses different 
standards for aircraft, certification for aircraft with fewer seats. 
Why should the number of seats be determinative? Why shouldn't 
complexity of the operation of the aircraft be determinative of the 
depth and extent of the review? 

Mr. ScovEL. Historically, the number of seats and the weight of 
the aircraft were useful measures for industry and FAA to deter- 
mine which set of regulations an aircraft should be subject to. As 
a result of this case, and to its credit, FAA's own efforts along these 
lines, they have recognized that specifically with respect to VLJ s, 
those measures are no longer valid, in the words of the SCR team 
that just reported out last week. FAA is working to develop regula- 
tions that will apply specifically to this new VLj segment of the in- 
dustry. 

Mr. Oberstar. Do you think FAA has learned the lessons of this 
experience with Eclipse? 

Mr. ScovEL. Every lesson helps. We will see over time, sir. 

Mr. Oberstar. We will see over time is right. We will follow 
them over time as well. 

Thank you, Mr. Chairman. 

Mr. Costello. Thank you. 

The Chair now recognizes the gentleman from North Carolina, 
Mr. Hayes. 

Mr. Hayes. Thank you, Mr. Chairman. 

For the edification of the audience, Mr. Costello and Chairman 
Oberstar had a wonderful conversation, as we always do, on the 
Floor after our last conversation here. Mr. Chairman, I might sug- 
gest, taking up on that conversation, Mr. Boswell was involved, too, 
really important questions here. Mr. Scovel is a great inspector 
general. But his answers to certain questions need to be put side 
by side with the FAA's answers on the same questions, and the 
aerospace industry answers to the same question. All of us have a 
perspective. 

What you just said about the weekend warrior being at 41,000 
feet in heavy weather, he is not going to be there. There is a fire- 
wall that nobody has mentioned here in this process. It is the in- 
surance industry. Nobody is going to issue an insurance policy to 
someone that is totally unqualified. 

Now, things happen. People who are beyond their capabilities get 
in trouble. Again, for clarification, autopilots, AHARs, all this stuff, 
are nice conveniences for pilots. But it doesn't change the basics of 
flying the airplane. So in the single-pilot thing, this airplane is so 
much simpler to fly than a typical piston twin, as a general state- 
ment, there is nothing wrong, there is everything right with this 
being a single-pilot program. 

Not a criticism of Mr. Scovel, but simply, there are a lot of per- 
spectives that have to be appli^ to this as we search for the right 
answer. Again, I don't think the FAA was wrong in all this. Type 
rating, you have to have a type rating if the airplane weighs more 
than 12,500 pounds. It weighs 6,000. So again, all these perspec- 
tives need to come into play. 

The issue, and Mr. Scovel, I have seven good questions here, and 
I would like to submit them to you for the record to get answered. 

I would also like to submit them to the other panelists so we can 
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again, side by side, put that information together as we evaluate. 
The first question is the important one. Is the Eclipse a safe air- 
plane to fly, from your perspective? 

Mr. ScovEL. Mr. Hayes, you are being gentle with me, I appre- 
ci ate that. 

[Laughter.] 

Mr. ScovEL. You have called me this Committee's hired skeptic 
before. I thought you were going to change that to the Dr. 
Kevorkian of the aircraft industry, and I am glad that is not going 
to happen. 

Is the Eclipse 500 safe? My office has no evidence that it is un- 
safe, and I would like to put that 

Mr. Hayes. That is a very good way to answer the question. Be- 
cause all of us have different levels to pug into this thing. I am try- 
ing to think, again, the redundancy here is remarkable. Back in the 
good old days, when Leonard and I were coming along, we didn't 
need redundancy, because there wasn't anything to fail. You had 
the needle ball and airspeed. That is still there, except now it is 
electronic. I got so many notes as we went along, issue of deadline. 

I think we should eliminate talking about deadlines. Everybody has 
a time line. Now, I am confident, it doesn't always happen, every- 
body involved here, if we had reached the time line, whatever the 
date happened to be, 2006 in this case, if this airplane were unsafe, 
somebody at the lowest level, medium or high level, could say, stop 
the parade, this is not going on the marketplace. 

So again, I think it is important that that feature is there. Do 
we always apply it? If it weren't for time lines, in the case of Con- 
gress, you have to say deadline, how would we ever get a bill to 
the Floor? Regardless of who is in charge, there is a certain busi- 
ness function to having a time line so that we can organize our pri- 
orities. 

So again, Mr. Chairman, your indulgence is much appreciated 
and your fine staff member, who I think the world of. As we look 
forward to ADS-B and next generation aircraft, as again, under the 
safety banner, we have to make sure that we as Congress and dif- 
ferent departments have the ability to raise our sights and levels 
of expertise so that we can keep American industry ahead of for- 
eign competitors, J apan, Brazil, Czechoslovakia and a number of 
other countries are working to beat us in this marketplace. We 
safely want to be out there ahead of them. 

But again, one last thing, the anomaly that occurred with the 
throttle, if you had sat down with the design team, that would 
never have come up. Physically, the pilot pushed, because of a go- 
around situation— it wasn't 41,000 feet— the throttle, which is a 
piece of metal, into another piece of metal. If this metal had been 
harder than this metal, it wouldn't have happened. But it went 
through the stop and it created a situation, it told the computer, 
we ne^ to go to 80 percent, we need to go all the way. 

So you look back, and you are dealing with a situation that, I 
don't know how you would have anticipated it, but it did happen, 
so now we deal with it in retrospect. But it was so unusual, a one- 
pilot, two-pilot, the pilots did what they should have done. I have 
too much power, how am I going to get rid of it? Well, I have to 
shut one of them off. So again, it is not a remarkable situation. 
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they are trained pilots. If you are going to fly a light sport aircraft, 
and that is out there kind of competing with VLJ s, you have to 
have the proper level of training. FAA is very much involved in a 
big part of that. 

Counterforces, we want to have new innovation that makes it 
safer, easier to fly, lots of gee whiz things, over here, safety of fly- 
ing is still the basics. Aviate, communicate, navigate, aviate first. 

Mr. Chairman, thank you. 

Mr. Oberstar. Would the gentleman yield? It wasn't a metal on 
metal problem. It was a software problem. 

Mr. Hayes. The software problem occurred after the human 
problem happened. 

Mr. Oberstar. No, there was a software problem and it was so 
admitted by FAA, so diagnosed by the Inspector General. That is 
the kind of thing that should have been fixed first before that air- 
craft went up. 

And I appreciate what the gentleman says about deadlines, but 
when the aircraft is not ready, the deadline should come last, not 
first. 

Mr. Hayes. I agree with the deadline last, not first. But reclaim- 
ing my time that I have, if a human being had not pushed a piece 
of metal through another piece of metal, the software would not 
have said what it said. He shouldn't have been able to do that. He 
did it. Nobody would have thought, who is going to jam the throttle 
through the stop? 

Mr. Oberstar. Okay. 

Mr. Costello. The Chair thanks the gentleman and now recog- 
nizes the gentleman from Iowa, Mr. Boswell. 

Mr. Boswell. I yield, Mr. Chairman. 

Mr. Costello. Mr. Hall. 

Mr. Hall. Thank you, Mr. Chairman. Thank you for holding this 
hearing. 

Mr. Scovel, thank you for your fine presentation, as usual. I am 
looking at one of your bullet points here about the FAA granting 
Eclipse authority to certify its own aircraft for airworthiness four 
years before obtaining a design certificate. That seems to me to be 
something that shouldn't happen. I just don't understand how that 
makes sense. 

During the last few years we have had more and more informa- 
tion come out before this Committee about the failure of FAA to 
perform adequate oversight over the companies the agency is sup- 
posed to be regulating. Too many other occasions, we have seen a 
cozy relationship between the agency and the airlines putting the 
safety of the American public at risk, and now we are seeing evi- 
dence of the same disturbing relationships developing between the 
agency and the airplane manufacturers, which is no less inappro- 
priate. I think I can speak for this entire body and say that my be- 
lief is the FAA's primary responsibility is and must always be to 
ensure the safety of the flying public. 

I am not a pilot. I am, however, thanks to my dad who taught 
me when I was five years old, a sailor. I have been dependent on 
different kinds of instrumentation. I like the redundancy of having 
analog gauges as well as digital displays. I am a little nervous 
about having only— and I am not up in the air, I am talking about 
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being on a body of water. I am a little bit nervous in only having 
the digital that can freeze up, until such time as it is proven to 
have all the bugs out of it. 

Let me ask you a couple of specific questions. We will hear testi- 
mony later on from an FAA manufacturing certification manager, 
who purchased professional liability insurance because of his con- 
cerns about his role in the certification program. Have you ever 
heard of a case of this occurring in the past? 

Mr. ScovEL. I am not aware of one. None has come to my atten- 
tion, sir. Again, we haven't worked in that area. In my less than 
2 years as Inspector General, it hasn't come to my attention before, 
sir. 

Mr. Hall. It appears FAA laid out approved methods for compli- 
ance, and in the case of the Eclipse, used workarounds or alter- 
native means of compliance and found reason for equivalent levels 
of safety, et cetera. So do you think that such phrases, such means 
to get around a problem by finding a workaround, are they poten- 
tially things that can be abused? 

Mr. ScovEL. Potentially; but I want to highly qualify that. Equiv- 
alent levels of safety have been used for a long time in the indus- 
try. I see them as a way to spark innovation. If FAA can determine 
that a new way to "skin the cat" will indeed get the job done, then 
why hold someone to what may have been the standard practice for 
a long time? Close scrutiny is required, however, and following just 
good common sense. But certainly it can be employed very success- 
fully. 

Mr. Hall. Another question. Allegations have been made by cur- 
rent and former FAA engineers and inspectors that the former 
CEO of Eclipse had an unusual amount of influence on senior FAA 
management. Did your investigators find any evidence that this 
was the case? 

Mr. ScovEL. We did not. I referred to the customer service initia- 
tive complaint regarding the single-pilot operation determination of 
FAA in December of 2006, j anuary of 2007, and clearly there were 
communications at that point. There were communications from 
Eclipse to FAA headquarters immediately prior to the production 
certification decision, when FAA determined that the new team 
needed to be sent to Texas and New Mexico in order to accomplish 
production certification. 

However, we haven't been aware of other aspects. 

Mr. Hall. That is good. And one last question, sir. We under- 
stand that Dayj et, the largest commercial operation utilizing the 
EA-500, refuses to operate the aircraft so far with a single pilot. 
Is this accurate and why do you think so? 

Mr. ScovEL. That is accurate, sir. Dayj et, based in Florida, is 
the largest user of the EA-500. It does use two pilots. We under- 
stand that is part of their business model. 

It also reflects a very cautious and conservative approach on the 
part of the company to the aircraft. 

Mr. Hall. Okay, thank you so much. I yield back. 

Mr. Costello. The Chair thanks the gentleman and now recog- 
nizes the gentleman from Missouri, Mr. Graves. 

Mr. Graves. Thank you, Mr. Chairman. 
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I am not going to belabor, we have a lot of panelists coming up 
and we have kind of gone through everything, Mr. Scovel. But I 
would like to say though, I would appreciate it in the future when 
you present things that you present your facts and your investiga- 
tion. When you use statements ancf throw them into the record 
from your people underneath you who are "weekend warriors," 
finding themselves in heavy weather at 40,000 feet, and they would 
be in a real, what was your term? 

Mr. Scovel. I n a fix, I think I said, sir. 

Mr. Graves. The fact of the matter is, if you are IFR trained, you 
train for just such an occurrence, with minimal instrumentation. 
And you assume that the worst is going to happen, whether it is 
looking at the copilot's panel, looking at your own panel, doing 
whatever you have to do, stick and ball, as Mr. Hayes pointed out, 
and as I have been trained. I would appreciate that you didn't 
bring those into this, because that is pure opinion and conjecture, 
and I don't think it has any place in a Congressional hearing 

Mr. Costello. The Chair now recognizes the gentleman from 
Iowa, Mr. Boswell. 

Mr. Boswell. Thank you, Mr. Chairman. 

I appreciate the discussion that you had earlier, Mr. Chairman, 
with Mr. Scovel about delegation does not mean self-certification. 
I think you have to depend on delegation to get work done, or the 
Administration does, and it works well. All good things, there his 
always a possibility there is an exception. But I just want to make 
the point that delegation is important and properly supervised, it 
works well. I would assume that you would agree with that. 

Mr. Scovel. I would agree with that, sir. 

Mr. Boswell. Okay. I also would kind of share some of the 
thoughts just made by the previous speaker, that the Very Light 
j et is designed, the training of the pilots is for single-pilot oper- 
ation. I don't want the public to get the idea this is a bad thing. 
Because they do have to go through some very stringent training, 
as you well know. 

Mr. Scovel. I do. 

Mr. Boswell. And they do practice for the worst case. At least 
that is what they did to me when I was going through, and I think 
that was a good thing. 

Mr. Scovel. They do, and I will note that Eclipse has its own 
training program for pilots buying its aircraft, and the company is 
working hard in that regard. 

Mr. Boswell. I appreciate that, and I don't argue the point that 
two is better than one. I suppose that would be a foolish thing to 
argue that point. But an aircraft designed, as you said earlier, be- 
cause the weight and all these different factors, then simplified 
procedure, then the training that goes with it, I don't want the 
public to think that a single pilot can't do that, because they can. 

I firmly believe that and I think you do, too. 

Mr. Scovel. I do. 

Mr. Boswell. All right. Thank you, Mr. Chairman. 

Mr. Costello. The Chair thanks the gentleman. 

Mr. Scovel, I only have a couple more questions at this time. You 
indicate, page 11 of your testimony, that Eclipse aircraft users con- 
tinue to report other post-design certification problems with the 
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EA-500, including erroneous stall warnings, flap movement failures 
and a high rate of tire failure. I wonder if you would comment on 
that. 

Mr. ScovEL. These problems, at least the first two, were identi- 
fied during the design certification phase, sir. They have been dealt 
with by the company and by FAA, largely satisfactorily, as the re- 
port of the special certification review team makes clear. However, 
in our review of the various safety reporting systems, to include the 
service difficulty reports, they have cropped up in months past. The 
tire failure question results from the intent of the company, the 
original intent at least, that the Eclipse 500 be used on grass run- 
ways, or at least non-paved runways. As it turns out, most of the 
aircraft are being used on paved runways, and because of the type 
of tire that is used — it is a softer tire — and also the angle at which 
it is placed on the landing gear, it is wearing unusually fast. 

Mr. Costello. The final question, on page 17, table 2, you have 
a table that says manufacturing deficiencies found by the FAA in- 
spectors after Eclipse inspectors certified the aircraft. And there is 
a whole list of deficiencies. Then you indicate that during the au- 
dits, the FAA inspectors identified serious non-conformities associ- 
ated with aircraft parts, materials or manufacturing processes used 
for the EA-500 by Eclipse suppliers. Then you go on to list, these 
include receiving or accepting non-conforming parts or tools, parts 
not properly stored or marked, failure to follow manual procedures, 
uncalibrated tools, revision of tools and procedures without ap- 
proval from Eclipse. And there are a number of other things. 

You say that additionally, at the largest user of the EA-500, FAA 
inspectors found problems with Eclipse supplier manufactured 
parts on 26 of the 28 EA-500 aircraft operated by the company. My 
question is, similar to my last question, have these issues been ad- 
dressed by the FAA? 

Mr. ScovEL. We understand FAA is in the process of addressing 
them with the company, sir. 

Mr. Costello. There being no further questions, we would allow 
a second round if you have questions. Mr. Hayes or Mr. Boswell? 
Very good. 

Mr. Scovel, we thank you for your testimony before the Sub- 
committee today. I expect that some time in the not too distant fu- 
ture, we will be sitting down with the FAA, the company and your 
staff to discuss the matter further. Thank you. 

The Chair would ask the second panel of witnesses to come for- 
ward. 

Mr. Hayes. Mr. Chairman, if I may, while they are coming for- 
ward, again, I didn't mean to be soft on Mr. Scovel. 

[Laughter.] 

Mr. Hayes. I just think it is important that we acknowledge the 
professionalism of all the folks that come in today. It occurs to me, 
as I am thinking about this, and this is really important, and I am 
glad you are doing it, but you have the facts. The facts are where, 
when, who, how. But then you have the truth. The truth is, the sig- 
nificance and meaning of the facts. What you just said about get- 
ting folks together beyond the process which occurs here so they 
can respond directly to the significant questions I think is a won- 



27 


derful idea. That gets us to the truth, to the best degree we can 
find it and understand it. So thank you very much. 

Mr. Costello. Actually, in my law enforcement days, I remem- 
ber it is who, what, where and why. 

I thank you for your comments, Mr. Hayes. 

The Chair would ask the witnesses to come forward. I will intro- 
duce them as they are. 

The first witness is Mr. Tomaso Di Paolo, with the National Air 
Traffic Controllers Association, Aircraft Certification National Rep- 
resentative. Mr. David Downey is the Vice President of Flight Safe- 
ty at Bell Hell copter -Textron. You all have the full titles and the 
companies that they are with. 

Mr. Dennis Wallace, who is a software engineer, Rotorcraft Di- 
rectorate, Aircraft Certification Service, with the FAA. Mr. Ford 
Lauer, Manager, San Antonio Manufacturing Inspection District 
Office for the FAA. Ms. Maryetta Broyles, Technical Program Man- 
agement Specialist, Manufacturing Inspection Office, for the FAA. 

Gentlemen and lady, would you please stand? I would like to 
swear the witnesses on this panel in. 

Please raise your right hand. Do you solemnly swear that the 
testimony you are about to give before this Subcommittee in the 
matters now under consideration will be the truth, the whole truth 
and nothing but the truth, so help you, God? 

[Witnesses respond in the affirmative.] 

Mr. Costello. Please have the record indicate that each of the 
witnesses on this panel responded in the affirmative. 

With that, the Chair will use the five-minute rule, as is cus- 
tomary for some of our witnesses with this panel. So I would ask 
you to try and summarize your testimony in five minutes, and that 
will give Members an opportunity to ask questions. 

Mr. DiPaolo. 

TESTIMONY OF TOMASO DIPAOLO, AIRCRAFT CERTIFICATION 
NATIONAL REPRESENTATIVE, NATIONAL AIR TRAFFIC CON- 
TROLLERS ASSOCIATION; DAVID A. DOWNEY, VICE PRESI- 
DENT, FLIGHT SAFETY, BELL HELICOPTER-TEXTRON; DEN- 
NIS WALLACE, SOFTWARE ENGINEER, ROTORCRAFT DIREC- 
TORATE, AIRCRAFT CERTIFICATION SERVICE, FEDERAL 
AVIATION ADMINISTRATION; FORD J . LAUER, III, MANAGER, 
SAN ANTONIO MANUFACTURING INSPECTION DISTRICT OF- 
FICE, FEDERAL AVIATION ADMINISTRATION; MARYETTA 
BROYLES, TECHNICAL PROGRAM MANAGEMENT SPE- 
CIALIST, AIRCRAFT CERTIFICATION SERVICE, SOUTHWEST 
REGION ROTORCRAFT DIRECTORATE, MANUFACTURING IN- 
SPECTION OFFICE, FEDERAL AVIATION ADMINISTRATION 

Mr. DiPaolo. Good morning. Chairman and distinguished Mem- 
bers of the Aviation Subcommittee. Thank you for the opportunity 
to testify before you today. 

I was asked here because in addition to nearly 20 years of service 
as an FAA aerospace certification engineer, I also serve as the air- 
craft certification national representative for NATCA. We represent 
aviation safety professionals, including aerospace certification engi- 
neers, flight test pilots and technical and administrative personnel. 



28 


approximately 20 of whom were involved in the type certification, 
or TC process for the Eclipse EA-500 aircraft. 

Since the summer of 2001, these employees witnessed the FAA 
acting in a way that was neglectful to their duty as industry regu- 
lators and irresponsible to the flying public. These employees were 
pressured to expedite the TC process, harassed by management 
and had their professional assessments ignored. As a result, an air- 
craft was allowed into the market without complying with Federal 
aircraft safety standards and regulations. NATCA filed a grievance 
over the FAA's inappropriate behavior, which is still in arbitration. 

At the time of final certification, there were many outstanding 
problems that had been identified by the engineers and pilots. 
These problems included pitot tube drainage issues in the airspeed 
indicating system, which failed due to freezing condensation in 
service. Problems with the electronics suite caused a pilot's screen 
to blank out and engines to operate in an uncontrollable manner. 
In some cases, FAA management allowed these concerns to fall 
through the cracks, while at other times it literally chose to ignore 
the technical reports that identified these problems in order to 
grant the TC without significant limitations. 

I n the months following the TC issuance, the problems identified 
by the engineers manifested during aircraft operation, putting the 
public at risk. Why after front line engineers had been able to iden- 
tify these problems did the FAA not act to ensure the concerns 
were addressed? The agency has faulty priorities that focus on the 
business goals of the private sector rather than protecting the safe- 
ty of the flying public. 

During a meeting between engineers and FAA management, 
J ohn FI ickey, Al R-1, told the group, "We are here to save this com- 
pany [Eclipse]." When one engineer responded that his job was to 
make sure the aircraft compli^ with the safety regulations, he was 
rebuked by Mr. FI ickey, who then went on to intimidate and ver- 
bally attack each individual on the team. FI is focus was codified in 
the FAA's 2006 business plan, which included the goal of certifying 
a Very Light J et by the end of the fiscal year. The pay system work 
rules that were unilaterally imposed on the aircraft certification 
bargaining unit on J uly 10th of 2005 included a pay for perform- 
ance system that rewarded managers for achieving goals outlined 
in the FAA's business plan. In other words, managers would be 
given bonuses for certifying the Eclipse 500 before September 30th, 
2006. 

By September 29th, 2006, the Eclipse 500 jet had not yet been 
approved. With the fiscal year about to end, bargaining unit engi- 
neers were harassed and pressured to sign off on the TC. That day, 
engineers responsible for each aspect of the aircraft refused to sign, 
due to outstanding technical safety concerns. The following day, a 
Saturday, September 30th, the last day of the fiscal year, FAA 
management ordered the Eclipse project manager into work and 
convinced her to sign off on a document that approved all remain- 
ing aspects of the jet. This enabled FAA management to grant the 
TC before the end of the fiscal year, qualifying them for pay in- 
creases. 



29 


This same compensation pi an created avenues for management 
to penaiize empioyees who refused to change their technicai opin- 
ions in order to meet the business time iine for certification. 

Since fiiing the grievance, the union has been approached by em- 
pioyees who were prevented from receiving fuii raises as retribu- 
tion for standing firm behind their safety findings during the 
Edipse TC program. The FAA aiso reiinquished its oversight re- 
sponsibiiities to the Edipse program. As eariy as 2001, FAA com- 
mitted to what they caii^ optimai deiegation, to the maximum ex- 
tent practicabie, meaning that whenever possibie, individuais se- 
iected by the company wouid act as surrogates of the FAA to deter- 
mine compiiance to safety standards. 

NATCA wouid iike to offer three recommendations to this Com- 
mittee. First, amend Titie 49 to aiiow the union to negotiate fair 
and professionai pay procedures that encourage and reward compii- 
ance to the safety mission of the agency. Second, the FAA's pay for 
performance system shouid oniy inciude goais that directiy improve 
the safety of the fiying pubiic. And finaiiy, deiegation must be re- 
stricted to individuais who are reviewed and approved directiy by 
the FAA. The core function of aircraft certification must remain an 
inherentiy governmentai function, to be performed by Federai em- 
pioyees. 

Thank you for this opportunity to testify. 

Mr. Costello. The Chair thanks you and now recognizes Mr. 
Downey. 

Mr. Downey. Good morning, Mr. Chairman, Members of the 
Committee. 

My name is David Downey, i am the Vice President of Fiight 
Safety for Beii Fieiicopter-Textron. i was the manager of the Rotor- 
craft Directorate in Fort Worth, Texas for seven years prior to as- 
suming my new position at Beii Fieiicopter. 

The events ieading to the Edipse 500 probiems are compiicated. 
Edipse was a brand new company trying to make a big spiash in 
the aviation industry. The CEO, Vern Raburn, created a very pub- 
iic and weii -documented awareness. 

This was a company that wanted to gain its type certificate, its 
production approvai and start deiivering aircraft aii within 15 
days. No amount of FAA coaching wouid dissuade Edipse execu- 
tives that this feat was not practicai and overiy ambitious. The 
FAA was concerned with the turnover in Edipse technicai per- 
sonnei. There were aiso technicai setbacks inciuding having to re- 
engine the airpiane. Edipse rareiy met its commitments to the 
FAA or submitted a report on time. 

On 14 September 2006, an FAA meeting was convened in an Ai- 
buquerque hotei. in attendance were FAA personnei and four FAA 
executives. Among the executives was the Service Director, Mr. 
Fiickey. it was compieteiy dear to aii present that the current ap- 
proach to the software certification was not going to meet the 
Edipse caiendar scheduie or Mr. Fiickey's direction, in this meet- 
ing, the software engineer, Mr. Waiiace, tried to convey to Mr. 
Fiickey that the Edipse approach wouid not meet the agency's es- 
tabiished and time-tested software certification procedures. Mr. 
Waiiace was summariiy subjected to a verbai barrage that con- 
veyed that he was not abie to think outside the box. 
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It was at this point I interjected myself between my employee 
and the Service Director. My taking up for him resulted in my 
dressing down and a humiliating verbal assault in front of my sub- 
ordinates. In 35 years of public service as an Army officer and an 
FAA employee, I have never suffered an experience as denigrating 
or unwarranted. It was clear to those present that Mr. Hickey was 
passionately making the case for thinking outside the box. 

However, the box must still be within the bounds of proven 
methodology and appropriate risk management. What some would 
portray as passion, I would characterize it as an assault on our 
professionalism and our character. We left that meeting knowing 
that it was our responsibility, the FAA, not Eclipse, to find a com- 
pliance solution to the software issue. 

There are other issues that FAA personnel became aware of. The 
FAA became privy to a mis-sent email detailing an Eclipse strategy 
to use Mr. Hickey's influence in the software certification issue. 
This Eclipse e-mail stated that Mr. Hickey would have to force us 
to accept this alternate approach. It would be fair to note that no 
evidence exists this email was ever sent to Washington. However, 
it did serve notice that no Eclipse tactic was out of bounds. When 
you couple all this together, the pattern of misinformation, missed 
dates and a willingness to go straight to Washington, D.C., that 
left the field FAA personnel trapped between Eclipse and Mr. Hick- 
ey and we knew it. 

Regarding the production program. Eclipse was trying to do too 
much with inadequate processes, poor controls and untrained per- 
sonnel. In March, 2007, I received a phone call from Mr. Hickey. 
Vern Raburn had called to complain. An email had been sent from 
Mr. Lauer to Mr. Byars at Eclipse explaining expectations for the 
reinspection and records review of aircraft serial number 3. From 
that phone call, and I paraphrase, Vern wants to know why the 
FAA wants the blankety-blank sealant records? I told Mr. Hickey 
I would find out. It was on this telecon I was also informed that 
Mr. Ron Wqjnar would assume oversight of the production and 
manufacturing issues and I was relieved. 

Back to the sealant records, after consulting with the experts, I 
learned the sealant records have to be examin^ to ensure the shelf 
life has not been exceeded. This was a properly conducted FAA re- 
inspection and records review. There was an Eclipse production 
certification report generated by Mr. Wojnar to Ms. Baker. It por- 
trays a story that is accurate in some regards but also has a slant 
and factual inaccuracies that would make the inspectors look over- 
bearing and zealous. It also contains misleading statements regard- 
ing myself and the Rotorcraft Directorate staff. 

The issues detailed are but a few of the issues the employees 
dealt with. The bigger cultural issue was the demonstrated lack of 
confidence in field FAA employees by Mr. Hickey and others. You 
will hear a different story from your subsequent panel. In fact, I 
expect to be maligned, disparaged and at best displayed as incom- 
petent. The record will speak for itself. 

The bigger concern is the tarnished reputation of field FAA em- 
ployees involved, particularly the ones who tried to raise concerns. 
There are 250 other companies that the Directorate oversees. Noth- 
ing else comes close to this situation. 
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Integrity is something I learned at the feet of my father, a 28- 
year career Army officer, and he is our patriarch. There are three 
generations of military service. One of my brothers is a serving in- 
spector general. I clearly understand the implications of these pro- 
ceedings. 

My decision to leave the FAA was reached over a year ago. The 
Eclipse 500 program was the tipping point. It was clear to me that 
my value system and my leadership style were in conflict with sen- 
ior leadership. It was time to close that chapter and move on. I 
have made mistakes in my career, but the handling of the Eclipse 
500 program was not one of them. 

Pending your questions, this completes my statement. 

Mr. Costello. Thank you, Mr. Downey. 

The Chair now recognizes Mr. Wallace. 

Mr. Wallace. Good morning, Mr. Chairman and honorable 
Members of this Committee. 

My name is Dennis Wallace. I am a software engineer employed 
by the FAA and I am currently assigned to the Rotorcraft Certifi- 
cation Office in Fort Worth, Texas, as the FAA's software technical 
specialist. 

I have been employed by the FAA for the past 12 years. Prior 
to my employment with the FAA, I worked for the Department of 
Defense in various positions for 26 years. I am also a veteran of 
the United States Air Force, having served 4 years on active duty 
and 21 years on active reserve. 

I am here before you today to give an account of my recollection 
of the events in the final days leading up to the issuance of an FAA 
type certificate for the Eclipse 500 Very Light J et airplane. My spe- 
cific role in this project was to provide typical FAA certification 
oversight of Eclipse and its supplier's development of airborne soft- 
ware for this aircraft to ensure that it satisfied the safety require- 
ments defined in the applicable Federal aviation regulations. Ac- 
cording to what the company submitted and FAA agr^ to. Eclipse 
and its suppliers were to develop their software in accordance with 
the guidelines of RTCA DO-178B as a means to secure FAA ap- 
proval for the digital computer software as a showing of compliance 
to 14 CFR 23.1301 and 14 CFR 23.1309. As there are no specific 
regulations that discuss how to certify software, these are the gov- 
erning safety regulations and DO-178B is the standard, FAA-rec- 
ommended approach for the certification aspects of airborne soft- 
ware. 

DO-178B was published in 1992 and has become the universally 
accepted governing procedure for such software certification efforts. 
DO-178B uses layers of checks and balances in an attempt to pre- 
vent errors from manifesting in the code. These include a defined 
and structured development process, independent peer reviews, 
quality assurance, configuration management and the rigor of test- 
ing that must be accomplished. 

On the morning of September 12th, 2006, while conducting a 
software review at one of Eclipse's suppliers, I received a telephone 
call informing me that I needed to attend a meeting at a hotel in 
Albuquerque on September 13th and that I should be prepared to 
give a status report for the software being developed by that par- 
ticular supplier. When I arrived for that meeting, I was prepared 



32 


to report the facts that the supplier had not yet completed final de- 
sign review, had not entered test readiness review, and that the 
company was aware that dead code still needed to be removed. 
Most importantly, I was also going to report that in my opinion, 
only approximately one-third of the required objectives of DO-178B 
had been satisfied. 

Instead of support, what I received was a rather harsh line of 
questioning from the FAA AIR-1 and AIR-100 managers that basi- 
cally questioned the validity and utility of the long-accepted DO- 
178B software certification procedure. They also hopped on the fact 
that there were no airworthiness rules specifically related to soft- 
ware certification. I tried to explain to them that Eclipse had 
signed up to comply with DO-178B for themselves and their sup- 
pliers. I went on to state to them that while it is true that there 
are no Part 23 rules that are unique to software approval, DO- 
178B is a traditionally and universally accepted means to secure 
FAA approval, which is applicable to all systems and equipment 
onboard the aircraft. 

Also, DO-178B provides a level playing field for all aircraft soft- 
ware developers and as such, it contributed to a standardized ap- 
proach to the software aspects and certification. I was told by the 
AIR-1 manager in what I perceived to be a very direct, animated 
and threatening manner that my position on this constituted anti- 
quated thinking and that I had best start thinking outside the box. 
Fie further stated that we were here to save a company and then 
looking directly at the then-Rotorcraft Directorate manager, said he 
"should have to come to Albuquerque to do his job." That was when 
I realized the supplier was not the problem, I was. 

On the following morning, I attended a meeting at Eclipse, along 
with other FAA personnel. In that meeting, the company proposed 
a mitigation strategy that the company wanted the FAA to accept 
as an alternative to the supplier having to satisfy software objec- 
tives of DO-178B. It is my continued opinion to this day that FAA 
management was strongly encouraging the FAA team to accept its 
proposed company mitigation strategy. 

The next week, I telephoned the supplier's designated engineer- 
ing representative and asked him to submit an FAA form 8110-3 
stating that the software satisfies DO-178B and complies with 
23.1301 and 23.1309. I received the requested 8110-3 stating that 
it was to the extent demonstrated by partial compliance with DO- 
178B. This became part of the mitigation package which I was 
asked to sign off on. I did so on September 28th by stating only 
that I concurred that the software partially complies with DO- 
178B. The clear implication here is that neither the designated en- 
gineering representative nor I concurred that the software was 
completely compliant. 

When I arrived at work on Monday October 2nd, I was surprised 
to hear that Eclipse had received its type certificate the previous 
Saturday, September 30th. 

This concludes my opening remarks. Thank you, Mr. Chairman 
and honorable Members of this Committee. 

Mr. Costello. Thank you, Mr. Wallace. 

The Chair now recognizes Mr. Lauer. 
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Mr. Lauer. Mr. Chairman, Members of the Committee, my per- 
sonai invoivement in the Eclipse project spanned the period from 
J uly 2006 to March 2007. In the J uly through December time 
frame, I made several trips to the Eclipse facility to assist the FAA 
program manager in various tasks. These tasks included inspecting 
the first production airplane. 

The FAA program manager and I witnessed functional test pro- 
cedures and inspected the airplane to verify it conformed to design 
drawings. The FAA program manager and I observed numerous in- 
stances where the airplane did not conform, yet had been signed 
off by Eclipse company inspectors and FAA designees as though it 
did conform. Eclipse company inspectors and FAA designees were 
repeatedly instructed by the FAA program manager that airplanes 
and functional test procedures should not be signed off and pre- 
sented for FAA inspection unless everything conformed. 

It was my perception that Eclipse employees were under con- 
stant pressure from their management to deliver airplanes. I ob- 
served that Eclipse management would not hesitate to complain to 
FAA management when they perceived FAA inspectors were inter- 
fering with Eclipse's ability to deliver airplanes. On numerous occa- 
sions when FAA inspectors told Eclipse personnel something they 
did not want to hear, the reply was to the effect that Eclipse could 
not live with that, and the issue would be elevated. 

To support the airplane delivery schedule. Eclipse expected an 
FAA inspector presence virtually around the clock and made this 
known to FAA management. As a result, I and several of the FAA 
inspectors worked a great deal of overtime at Eclipse, including 
weekends and holidays. 

In late January, Eclipse presented the second production air- 
plane for FAA inspection and airworthiness certification. Eclipse 
had submitted signed FAA forms containing certifying statements 
that the airplane had been inspected by Eclipse, was found to be 
airworthy, conformed to its type certificate and was in condition for 
safe operation. The FAA inspector's inspection of the airplane indi- 
cated that Eclipse had neglected to adequately inspect the airplane 
before making application for an airworthiness certificate and thus 
possibly violated FAA regulations by making an apparent false 
statement on the FAA forms. 

I consulted with the Rotorcraft Directorate Manufacturing In- 
spection office manager in Fort Worth and it was determined that 
an investigation should be initiated for a possible violation of Fed- 
eral regulations. An investigation case was initiated in accordance 
with FAA policy. It should be noted here that FAA policy estab- 
lished that every apparent or alleged violation must be investigated 
and that the enforcement investigation report is the means for doc- 
umenting an investigation. 

In mid-March, the FAA aircraft certification service director as- 
signed a senior advisor from outside the Rotorcraft Directorate to 
assume responsibility for the Eclipse project. FAA inspectors were 
notified that they would report to the assigned senior advisor for 
all Eclipse production and airworthiness activities. 

I was informed by the Rotorcraft Directorate Manufacturing In- 
spection office manager that the senior advisor wanted the in- 
progress investigation suspended immediately and the case was to 
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be closed with no further action. The investigation was suspended 
and the case closed as directed. 

In mid-March, the senior advisor implemented a working agree- 
ment between Eclipse and the FAA, known as a project-specific cer- 
tification plan. Language within the project-specific certification 
plan established that the FAA would recognize and utilize Eclipse's 
FAA designees to the greatest extent possible in inspecting Eclipse 
airplanes. FAA inspector utilization of FAA designees has been a 
common FAA practice, but only after companies have been able to 
demonstrate that their inspectors and FAA designees were reliable. 

In order to streamline FAA inspection of Eclipse airplanes, a 
flowchart within the project-specific certification plan established a 
set amount of time for FAA inspection of each airplane. Language 
within the project-specific certification plan also established that 
the FAA would not require removal of airplane interiors, floor- 
boards, et cetera when FAA inspections were performed. 

In mid to late March, I made the personal decision to obtain pro- 
fessional liability insurance. I want to emphasize that throughout 
the time of my involvement in the Eclipse project, management 
within the Rotorcraft Directorate never once pressured me to do 
anything that was contrary to FAA regulations. I have no personal 
reservations concerning any level of Rotorcraft Directorate manage- 
ment and consider them all to be high caliber people. 

This concludes my statement and I await the Committee's ques- 
tions. 

Mr. Costello. The Chair thanks you, Mr. Lauer, and recognizes 
Ms. Broyles. 

Ms. Broyles. Thank you, Mr. Chairman. 

I am an aviation safety inspector in the Manufacturing Inspec- 
tion Office of the FAA in Fort Worth, Texas. One of my duties as 
an ASI is to evaluate new and existing manufacturing companies 
that produce commercial aircraft and new replacement parts. I 
have worked for the FAA for 20 years, and during my tenure as 
an inspector, I have performed over 485 evaluations of aircraft 
manufacturing facilities and pride myself in being very thorough. 

j uly 2006, I was a team member of the preliminary district office 
audit at Eclipse Aviation for the issuance of approved production 
inspection system. Fifteen non-compliances of the system were doc- 
umented. In September 2006, we returned to Eclipse to review the 
corrective actions from the j uly audit. Corrective actions were not 
presented, so we continued with the ongoing district office audit. 
Twenty additional non-compliances were identified. From the j uly 
and September audits, a total of 35 non-compliances were docu- 
mented. 

In December 2006, I returned to Eclipse. Our management con- 
veyed to us that we were to work on nothing but the airworthiness 
of the first production aircraft. Eclipse presented the aircraft to the 
FAA with a signed statement of conformity and we began con- 
ducting tests. Of the 28 tests performed, 11 passed. The official 
production certification district office audit was conducted February 
2007. Forty-two non-compliances were documented. Three audits of 
Eclipse's quality system had been conducted. Seventy-seven non- 
compliances were documented. Thirty-five of those did not have 
verification of corrective action. 
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My impression was that Eclipse was controlling FAA's schedules 
and managing our resources. For instance, our managers denied 
the request for us to return to Fort Worth due to weather condi- 
tions, although most of the Eclipse employees were told to leave 
due to hazardous weather. In April, Eclipse was preparing an air- 
craft for certification and told the FAA inspectors to go back to the 
hotel, but be ready for their call, even though it may be midnight 
before the aircraft was ready. 

March 2nd, 2007, an FAA aircraft certification director appointed 
an independent team to oversee airworthiness and the production 
certificate for Eclipse. The Rotorcraft Directorate manager, FAA 
principal inspector and the MIO, manufacturing inspection office 
inspector, were removed from the program. In April 2007, I was on 
the team for the production certification board. Sitting in the back 
of the room was the independent team appointed by Mr. John 
Flickey, which consisted of five managers. During the internal FAA 
in-brief, the independent team leader talked about how the com- 
pany had improv^ since he had been appointed and stated that we 
should do a high level, or overview of the system because the com- 
pany had already been audited numerous times. It was then stated, 
in other words, we need to only go an inch deep when conducting 
the audit. 

I was shocked when I heard this statement. FAA Order 8120.2D 
provides guidance for the issuance of a production certificate and 
states that the production certificate board is responsible for mak- 
ing a thorough evaluation of the applicant's quality system and 
production facilities. Conducting an overview of the system when 
corrective actions were not verified and functional tests were fail- 
ing was in conflict with our guidance. 

I began my evaluation of the manufacturing system and found 
issues for the horizontal stabilizer assembly and requested the 
drawings to evaluate the condition further. One drawing led to an- 
other. My Eclipse escort said to me, "Maryetta, you are going more 
than an inch deep. You are going too deep." I was surprise that 
my escort had heard that statement. I do not know how he received 
the same information that was briefed only to the FAA. 

In all my years as an inspector for the FAA, I have never felt 
the pressure from FAA managers that I felt when Eclipse was try- 
ing to get their production certificate. We were being monitored on 
our performance and with the removal of managers and inspectors 
from the project, I was cautious about what I said and did. I have 
successfully approved several other companies for production and 
have never experienced this level of involvement or monitoring 
from Washington headquarters. We followed our guidance and reg- 
ulations and spent enormous amounts of time coaching and pro- 
viding assistance to Eclipse. Issues were identified to prevent safe- 
ty problems. We were directed to get the job done and money and 
resources was no object. 

I am proud to represent the FAA and be a part of a world class 
organization in advancing aircraft safety. Our actions during this 
trying time were honest. 

One of the core values of Al R is to praise each other publicly and 
recognize and regard others for excellence. I feel the inspectors 
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were pressured and discredited when we were trying so hard to ac- 
complish our job. 

This concludes my statement. I await the Committee's questions. 

Mr. Costello. The Chair thanks you, Ms. Broyles. 

Let me b^in, Mr. Downey, with you. You indicated that there 
was a meeting on September 14th, which you attended, and a 
meeting called by Mr. Hickey, where Mr. Hickey made a comment 
at the meeting that "we're here to save a company." What did that 
mean to you? Did it mean that whatever it takes, we are here to 
save the company? 

Mr. Downey. It would be my opinion, sir, that there was a bal- 
ance trying to be struck here between a company that was going 
to go under because they had made financial commitments and 
meeting all the requirements as outlined in our policy and in our 
rules. We were made aware that there were financial implications 
to a TC date tied to the issuance of the engine type certificate as 
well as when the company got their type certificate. 

Mr. Costello. On page 6 of your testimony, you indicate that 
the FAA agreed to numerous lOUs, which of course we are aware 
of, from EAC, and that this is not uncommon, but the FAA per- 
sonnel were under a great deal of pressure. From the testimony 
that we hear from everyone, let me draw a conclusion here, and if 
I am wrong, tell me that I am wrong, if anyone disagrees, is that 
you all believe that this whole process was driven by a calendar 
and a date of September, the end of September 2006. I s that cor- 
rect? 

Mr. Downey. Yes, sir. 

Mr. Costello. Anyone disagree with that statement? 

Mr. Downey, if you would, explain to the Members of the Sub- 
committee what the purpose was of the meeting that you attended 
and what happened at that meeting? 

Mr. Downey. The purpose of the meeting was a gathering of all 
the FAA inspectors, engineers, pilots and test pilots to basically de- 
termine where we were, since there was a meeting the following 
day, a "program review" called by Eclipse and Mr. Hickey. So it 
would be a precursor to a meeting on the following morning where 
we would basically walk through each of the major systems on the 
aircraft and the schedule for both production and for type certifi- 
cation. 

Mr. Costello. Did you find that it was unusual that as the chief 
executive of the FAA's certification organization that it was un- 
usual for Mr. Hickey to take such a personal involvement, personal 
interest in the EA-500 certification program? 

Mr. Downey. Yes, sir. 

Mr. Costello. Can you either tell us why you believe that or 
speculate as to why you found it unusual? 

Mr. Downey. My speculation, sir, would be that there were sev- 
eral programs that were highly visible and that the VLj market 
was a new toy, if you will, on the aviation scene. Mr. Raburn, 
through numerous articles, numerous events, including the pre- 
vious roll-out at Oshkosh with their provisional type certificate, 
had created a public spectacle, and we were going to be part and 
party to that and we weren't going to miss that date. 
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Mr. Costello. You mentioned in your testimony or suggest that 
the company intended to go straight to Washington, D.C. when 
they didn't like how things were going at the office. Elaborate on 
that if you will. 

Mr. Downey. The previous week to that September 14th meet- 
ing, we were attending, several of the executives were attending a 
meeting in Washington, and we were called in. That is when Mr. 
Hickey said, I want a program review, I want to know what is 
going on, I want to know why we are not going to make this. And 
it was completely out of left field for me to understand why we 
were going to be, the gain had been turned up on this to this level. 

Mr. Costello. You also mentioned in your testimony that there 
was an email that was apparently intended, on August 31st of 
2006, an email from an Eclipse manager to senior Eclipse manage- 
ment, but it was accidentally sent to an FAA employee. Describe, 
if you will, what was in that email. 

Mr. Downey. The email basically said, we have to get the fol- 
lowing, Hickey has to make sure that the following gets done. And 
among them was, they have to accept our approach to the software. 
And there were three or four other things in there, sir, and I have 
the references I can submit to the Committee if you would like. 

But what it said to us is, if we don't figure out a way of doing 
this, there will be hell to pay. And it was mentioned on numerous 
occasions. Vern Raburn made no mistake about dropping the Ad- 
ministrator's name. Governor Richardson's name, the Senatorial 
staff. And we knew that there would be political pressure applied 
to us. That can be done in a number of ways. 

Mr. Costello. You also mentioned in your testimony that 
Eclipse was not qualified to receive a production certificate, in your 
opinion. Give us an explanation, if you would. 

Mr. Downey. Well, as the members of this panel elaborated, sir, 
the number of hours that our employees spent going through the 
quality system to ensure the various elements of it, the supplier 
control, receiving inspection, the actual hands-on inspection of the 
aircraft, and I was over there numerous times. I even went back 
through my travel vouchers to look at it. And in fact, I remember 
a specific incident with inspectors where they went out to look at 
the aircraft and the aircraft just flat did not pass the test proce- 
dures that were outlined. Screens went blank. Fuel lines were chaf- 
ing. Wiring was chafing. And this was not stuff that was like hunt 
and peck to find it, it was blatant and people saw it. 

So based on that, sir, and the fact that we in the directorate, to 
use a Texas phrase, this wasn't our first rodeo— we had been 
through this before. And our folks knew what they were doing. 
They were professional, they were competent. I was very, very com- 
fortable that the leadership team in place had a very good idea of 
what they needed to do. I learned a long time as a leader, you train 
your people, you turn them loose and you let them go do their job. 
They had never failed me or my staff in that regard. 

So I have no reason to believe that the issues that were being 
brought to bear at that point in time were malicious or inaccurate. 

Mr. Costello. Mr. Wallace, why do you believe that senior man- 
agement perceived you to be the problem? 
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Mr. Wallace. Because I wasn't going to approve the software. 
That is why I perceived that I was the problem. 

Mr. Costello. Do you still stand by your decision today that you 
would not have approved the software that was in the condition 
that you saw it in September of 2006 on the aircraft? 

Mr. Wallace. That is correct. 

Mr. Costello. I have some other questions. But at this time, the 
Chair now recognizes the Ranking Member of the Subcommittee for 
questions, Mr. Petri. 

Mr. Petri. I guess I am trying to figure out how to put this in 
context and what if anything we should be doing about it going for- 
ward to help the FAA do a good job of ensuring airworthiness for 
new, innovative craft. I know, I represent the EAA in Oshkosh, so 
I am very aware of how excited the aviation community, especially 
the general aviation community, has been about the new type of 
airplanes that Eclipse represented. I suspect there is a lot of pres- 
sure, not badly motivated, but people who wanted this thing to suc- 
ceed. 

And then now our issue is, people aren't saying the plane that 
is out there now is unsafe. They think it probably is airworthy. But 
there were a lot of steps along the way where things were not cor- 
rectly managed or handled. There were personality conflicts as a 
result of that, in the effort to try to get this thing certified with 
a new manufacturer. 

Were you involved, also there were two other planes, similar 
planes, I think a Swearingen and a Cessna that were of this gen- 
eral type that were also going through the certification process at 
about the same time? 

Mr. Downey. Yes, sir. 

Mr. Petri. They were certified before this one. If you were in- 
volved in both, could you describe, is it mainly that these were ex- 
perienced manufacturers and teams that had regular relationships 
with the process and that this one with the Eclipse was a new 
team and they were having problems there? Is there some dif- 
ference? Why were they able to go through this process without 
these, or were they able to go through this process without these 
problems? What would explain the Eclipse's, the bumps in the 
road, so to speak, in the Eclipse certification process? Does anyone 
have any comments on all that? 

Mr. Downey. Sir, I can speak to the Sino Swearingen SJ 30, be- 
cause that was a program under our responsibility as well. That 
company suffered from many of the same issues along the way. 
They suffered a very unfortunate fatal accident at Christmas time 
a couple of years prior to that, and I was intimately involved in 
that. And I can't speak to the Cessna Mustang, although Cessna 
is a longstanding manufacturer. 

I would say the differences were, we did not provide the same 
level of resources to Sino. Sino suffered, like I said, from some of 
the same ills in terms of, they had problems with the fuel system 
along the way. They had problems with the conformal wing. They 
had other issues that were similar in terms of technical challenges. 
But we just didn't see the same level of help from Washington, if 
you will. 
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Mr. DiPaolo. Congressman, I would like to build on that as well. 

I n talking to the NATCA representatives that worked on those pro- 
grams, the differences that I was made aware of was the fact that 
when those airplanes did get their approval, they were approved 
with limitations. And sometimes those limitations are pretty harsh 
on the aircraft, it doesn't allow the aircraft to do a lot. Maybe you 
can only fly in day time. 

That wasn't the case with the Eclipse program. These lOUs were 
underhanded, to state it in one manner. If a limitation is nec- 
essary, as the engineers that is what we do. Sometimes at the end 
of the program there is a rush. We understand we don't have all 
the testing done, and we put a hard limit on that airplane. What 
that does is that is the incentive. Because that aircraft manufac- 
turer does not want to live with that limitation. They come back 
and we agree to further testing to try to remove that limitation. 
But I have never heard of an lOU being issued. 

Mr. Petri. I have other questions, but I will wait submit them 
in writing. 

Mr. Costello. The Chair thanks the Ranking Member and now 
recognizes Mr. Boswell from Iowa. 

Mr. Boswell. Thank you, Mr. Chairman. Anybody who wants to 
can answer, I guess I'm thinking of Mr. Downey. Strong criticism. 
Nobody can question that. I just wonder if I could ask, have you 
experienced other instances wherein this type of pressure to push 
or rush the process in your experience with FAA? 

Mr. Downey. None that I can recall first-hand, sir. I have to tell 
you, we were pretty well consumed by this one. 

Mr. Boswell. I appreciate that. I was hoping you would say 
that. But I wanted to hear it from you because of things that you 
probably heard me say earlier, some couple of hours ago. So this 
is not what you would refer to, and I am not trying to put words 
in your mouth, this is not a normal circumstance in your experi- 
ence with FAA? 

Mr. Downey. No, sir. 

Mr. Boswell. Thank you. No more questions. 

Mr. Costello. The Chair thanks the gentleman and now recog- 
nizes the gentleman from North Carolina, Mr. Flayes. 

Mr. FI AYES. Thank you, Mr. Chairman and gentlemen and Ms. 
Boyles. Thank you for coming today. I know it is probably not 
something that you greatly looked forward to, so we appreciate 
your willingness to step up and give your view of the situation. 

An observation, there is an ongoing rift between the FAA and 
NATCA over various and sundry issues. That is reflected in some 
of the comments, in my opinion, that you have made today, and 
they don't fit in this hearing. That is just an observation. 

Mr. Downey, I don't know, unfortunately you have been called on 
to do a lot of talking. I want to spread out my questions to others, 
but several things that you said, and again, this is not in any way 
questioning your experience or loyalty or anything else. But looking 
at the process, there is management and those folks that work for 
management. I have been in the management position, I have had 
to terminate people and I have had to transfer people. I can't re- 
member too many instances where that person thought it was a 
great idea. But there comes a time when one has to manage. 
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Now, as a general question, and anybody, I would welcome your 
answer, over a period of five years, 2001 through 2006, the pres- 
sures that are normal in something this complicated, something 
this important, is it possible that there was a level of, my word, 
tiredness that developed between the inspection team and the man- 
ufacturer? Did that occur? A level of frustration equally applied 
both ways? Does that affect anything here? Mr. DiPaolo? 

Mr. DiPaolo. Mr. Hayes, the program started, as you know, in 
2001. It was a complex program, and the FAA granted an exten- 
sion. Because usually these programs take about three years, ac- 
cording to the regulations. Eclipse was granted an extension in 
2004. So they had until 2007 to complete the program, and if nec- 
essary, they could have applied and received another extension. 

Mr. Hayes. Well, that is not my question. Had a level of 
tiredness between the inspection team and the manufacturing team 
developed? 

Mr. Downey. Sir, I will comment on that. 

Mr. Hayes. All right. 

Mr. Downey. I don't believe so. 

Mr. Hayes. Well, I definitely believe so, having heard from man- 
agement, both on the manufacturer's side and the FAA's side. Nei- 
ther right nor wrong, but at certain times, you are sick and you 
are in the hospital and you are not communicating with your team 
of doctors and you change teams. That is not necessarily a negative 
reflection. It is just time for a new look. 

So again, to keep this in perspective, I think it is important that 
that be a part of this discussion. 

Now, you mentioned, Mr. Downey, and I do take issue with this, 
the VLJ was a new toy on the aviation scene. Not a new toy. It 
is a new product, it is a new concept. As a salesman, nothing hap- 
pens until somebody sells something. If you are going to the bank, 
whoever, and you have a business plan for some new device, 
whether it be a lawnmower or an airplane, you are going to have 
to tell the people loaning you the money, we expect to do this. So 
a lot of the things that you are pointing to, again from my perspec- 
tive, critically, are part of doing business. And it is not a toy. It 
is an important concept in aviation. 

Again, it is not your obligation to keep the U.S. competitive, but 
we are all a team here. Congress and everybody else. I am frus- 
trated at this moment with some FAA folks for a constituent who 
just can't find the time to do what they need to do to conduct their 
business. So a lot of what we are talking about here is part of man- 
agement, it is part of every day. 

Now, given where we are, what would you like to see us do, since 
we are in this, to make sure that the process works, that the public 
is safe and the United States economy is kept moving forward and 
those jobs stay here and we use less fuel and all the above? Any- 
body want to touch that one? 

Mr. DiPaolo. I will take that one. 

Mr. Hayes. Okay, and please feel free to contact me after this 
hearing. I would wdcome the opportunity to talk to you individ- 
ually or as a group. I am sorry we don't have much time, but go 
ahead. 
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Mr. Di Paolo. Much appreciated, sir. We do have limited re- 
sources in aircraft certification. There is a limited number of peo- 
ple. You may hear the FAA say there is 1,100. But the actual num- 
ber of engineers that are working these projects day in and day out 
is around 300 people. So to use those resources, we do need a little 
increase in the number of engineers. That would be helpful, and we 
know Congress has allowed us to do that in the past. 

Mr. Hayes. Thanks for the comment. Mr. Costello and I were 
just talking about that, that the management of FAA says they 
have enough people. Well, obviously they don't. So you made your 
point, Mr. Chairman. Thank you. I will be back in a little bit. 

Mr. Costello. Thank you, Mr. Hayes, and you are correct. We 
have asked that question over and over again. 

Before you leave, let me just point out, let me join Mr. Hayes in 
thanking you all for being here. We still have other questions. But 
I do think it is worth pointing out, and you correct me if I am 
wrong, Mr. Downey, all of your performance evaluations when you 
were with the FAA were either excellent, or did you ever receive 
a performance evaluation the entire time you were with the FAA 
that was substandard or below standards or critical of your work? 

Mr. Downey. During my entire 13 years, sir, all of my end of 
year performance appraisals were successful. 

Mr. Costello. And the day you left the FAA, and you did not 
leave, as you clarified in your testimony, you did not leave as a re- 
sult of this project, you left for a number of other reasons, you went 
immediately and were hired as Vice President of Flight Safety for 
Bell Helicopter-Textron, is that correct? 

Mr. Downey. Yes, sir. 

Mr. Costello. I thank you. When Mr. Hayes comes back, I will 
make this point in his company. He makes a point about changing 
teams. And it may not be unusual to change teams if you are not 
getting the desired results or from time to time. We had a hearing 
of the Full Committee in April of this year where we found the 
same situation, where the FAA changed teams. So it is just not 
something that has happened in this instance. It is apparently part 
of a pattern at the FAA when they are not getting their desired re- 
sults from their employees, they move a team out and put a team 
in place to achieve those results. So just for the record, I wanted 
to clarify that. 

And now the Chair will recognize the distinguished Chairman of 
the Full Committee, Chairman Oberstar. 

Mr. Oberstar. Mr. Chairman, I want to compliment this panel 
on their courage in coming forward and the professional integrity 
they have demonstrated in raising the concerns and the alarms 
that they have sounded for us, and for supplying the information 
that is important to understanding this process, the process of cer- 
tification that is so troublesome. I thank each of you for your pro- 
fessional integrity and concern for safety and for a proper process 
of safety. 

Mr. Di Paolo, notwithstanding what Mr. Hayes was trying to do 
to undercut your testimony, I think he is wrong. NATCA and FAA 
have had differences on a different matter, totally different subject 
matter. NATCA represents a certain class of FAA employees here. 
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and you are representing them in their concern for what happened 
within the agency, not what happened on another case. 

Mr. Di Paolo. Correct. 

Mr. Oberstar. And I don't, I can't let the record go unchal- 
lenged; I can't let those statements go unchallenged. I think it is 
totally inappropriate to have made that comment. 

Mr. Di Paolo. I appreciate that, sir. I mean, we reached the tip- 
ping point during that program. I had never seen the level of har- 
assment from FAA management, I had never seen the level of open 
safety concerns, and that all had come together. We used the only 
means we really had, which was a grievance, to protect our bar- 
gaining unit employees. 

Mr. Oberstar. I have done oversight work for 40 years in the 
Congress, as a staff and as a Member. I know integrity when I see 
it, and honesty and courage, and you have all demonstrated that. 
Mr. Downey, you said the FAA set the September 30th, 2006 goal 
for issuance of the TC, you said that, or you suggest that was the 
same date that Eclipse was tied to for their financial, for additional 
financial backing, is that correct? Flave I stated that right? 

Mr. Downey. I don't know the exact particulars, but what we 
shared with the team and what was shared with me was that there 
were financial implications and backing tied to 30 days from the 
date that the Pratt and Whitney engine type certificate was vali- 
dated through the FAA for them to get their type certificate. I have 
never seen anything in writing, sir, but that is what was shared 
with the team through the company. 

Mr. Oberstar. When did you learn all of this? 

Mr. Downey. It would have been some time around the begin- 
ning of September, because all of a sudden the dates started be- 
coming hypercritical. 

Mr. Oberstar. Flave you had experience before in the certifi- 
cation process where a date was set by which you had to accom- 
plish something, rather than meeting a goal? 

Mr. Downey. I would share with you, sir, that the marketing 
portions of most companies set dates, and we tend to put those in 
what we call jello. They are not going to be hard and fast, they are 
always a target. But sometimes you miss targets. There are cer- 
tainly examples in the press today of a certain manufacturer that 
is going to miss it significantly. 

So my attitude about that was, it is a date, it is a Power Point 
slide, but much beyond that, we will do it right. 

Mr. Oberstar. You also said that your training in software ap- 
proval informed you or guided you that approval of the software 
should be event-driven, not calendar-driven. What did you mean by 
that? Explain that. 

Mr. Downey. Well, sir, as I stated in my written submission, in 
the military I attended the Defense Department's program man- 
agers course. That is a course obviously designed to help you run 
major military programs, products and it was actually a lawyer 
that was teaching that portion of it. What he said is, software be- 
comes movable to the next event once it completes all of the 
verification and validation. As Mr. Wallace said in his testimony, 
there are certain gates that you go through to make sure that the 
software meets a level of certitude. And if you see it, as I state in 
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my written submission, if you see a calendar schedule, run the 
other way. IN other words, there is not a firm grasp of what soft- 
ware implications are in terms of running a program. 

Mr. Oberstar. Thank you. 

Mr. Wallace, you are a software certification specialist for the 
certification service, correct? 

Mr. Wallace. Yes, sir. 

Mr. Oberstar. And you teach the subject at the FAA Academy? 

Mr. Wallace. I do. 

Mr. Oberstar. As you reviewed the Eclipse process, they had an 
alternative means of compliance for software certification. Was that 
adequate, inadequate? What was your judgment of it? 

Mr. Wallace. I believed it to be inadequate to be presented at 
the eleventh hour. Usually when a company wants to do an alter- 
nate means, it is presented at the beginning of the program, not 
at the very end of the program. 

So in this particular case, there probably should have been an 
issue paper issued and processed and been reviewed by several peo- 
ple. But again, this came about at the very eleventh hour. 

Mr. Oberstar. And did that software alternative approach have 
a connection with the software problem that occurred in the Eclipse 
aircraft at altitude? 

Mr. Wallace. I couldn't say for sure. 

Mr. Oberstar. Is enough known about that software short- 
coming, failure, glitch, as it has been variously described? Is 
enough known about that at the present time to make a judgment 
about whether there was a significant failure? 

Mr. Wallace. Well, again, I think I would have to go back to the 
point in time you are referring to, which I really don't know. Be- 
cause there are different configurations of that software. If you are 
talking about at the time of the type certificate, there were a cou- 
ple of software issues that it went into type certificate with that 
I was aware of. One of course was the, in my opinion, the incom- 
plete development of the software from one particular supplier. The 
other one had to do with the AHARS, which was causing, there 
was a bug in the pit processor that was eventually causing the 
screen to freeze. They would have to reset through the watchdog 
timer. 

So it was a combination of both the AHARS and the primary 
flight display that was causing a problem. 

Mr. Oberstar. In fly-by-wire technology, it seems to me those 
issues should be worked out thoroughly before they are allowed to 
go forward in an aircraft and allow that aircraft to be operational. 

Mr. Wallace. Well, Congressman, this is not a fly-by-wire air- 
craft, but it is a highly automated aircraft. I would agree with you, 
yes. 

Mr. Oberstar. You wouldn't call it completely fly-by-wire? 

Mr. Wallace. It is not fly-by-wire, no, sir. 

Mr. Oberstar. But the software is essential to its operation? 

Mr. Wallace. Absolutely. Absolutely. 

Mr. Oberstar. So at least that should have been fully vetted and 
fully tested. FAA is very good at that. They are often criticized in 
the air traffic control technology side by the industry, by users, oh, 
you took too much time to test this, your insistence on testing is 
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slowing down the process of modernization. And yet FAA has been 
very insistent, very good on that point of not putting something, 
not putting a piece of technology into operation until they are con- 
fident it is going to work 100 percent, the way they expect it to do. 

Mr. Wallace. Yes, sir. 

Mr. Oberstar. And in this case, that didn't happen. 

Mr. Wallace. In my opinion, no. 

M r. Oberstar. Why was that? 

Mr. Wallace. Because the process wasn't allowed to work. We 
have an established process called DO-178B, and in this particular 
case, it wasn't allowed to come to fruition before I could approve 
that software. 

Mr. Oberstar. Who didn't allow it to come to fruition? 

Mr. Wallace. Well, I can only speak for myself, Mr. Congress- 
man. I signed off that mitigation strategy by saying I concur that 
the software only partially complies to DO-178B. 

Mr. Oberstar. But then after it left your hands? 

Mr. Wallace. When it left my hands, sir, that was very shortly, 
within a few days, they received the TC. And I moved on to other 
projects. I had other projects, and as far as I was concerned, that 
was it for me, I was done on that particular project. 

Mr. Oberstar. Well, you stand by your decision then not to sign 
off on it? 

Mr. Wallace. Yes, sir. 

Mr. Oberstar. You referred to a book promoted by FAA manage- 
ment as a must read. You said, the bus had left the station, not 
only was I not on the bus, I felt I was being thrown under the bus. 
What does that mean? 

Mr. Wallace. There was a book that was promoted by FAA 
management on management techniques. At that particular meet- 
ing on the 13th of September, I realized two things, one, that the 
supplier was not the problem, I was the problem because I was not 
going to approve that software. Then I realized also that the bus 
had already left the station and not only was I not on the bus, I 
felt I was being thrown under the bus, in other words, I was being 
overridden by management for technical decisions that I thought I 
was in a better position to make an assessment of. 

Mr. Oberstar. And you have had a lot of professional experi- 
ence. Flave you been overridden before in your field of expertise? 

Mr. Wallace. No, sir, I don't recall having been overridden be- 
fore. 

Mr. Oberstar. So Mr. FI ayes' comment that oh, sometimes deci- 
sions have to be made, management decisions have to be made, 
people have to be moved, is irrelevant to this issue. 

Mr. Lauer, you testified that in March 2007, you made the deci- 
sion to purchase professional liability insurance. I have never 
heard of anyone doing that within the FAA. Why did you feel that 
was necessary? 

Mr. Lauer. Principally because the project-specific certification 
plan I referenced in my oral summary, it limited our ability to in- 
spect those airplanes, certain portions of it were off-limits. Time- 
wise, we had roughly 12 hours to inspect those airplanes and no 
more. 
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Bottom line is, if I am not free to look at every part of the air- 
craft I need to, then I can't be confident that it truly conforms and 
is in a condition for safe operation. Yet I am expected to sign and 
issue an airworthiness certificate for that aircraft. Forward think- 
ing, if something were to happen down the road, NTSB comes 
knocking on my door, I was just wasn't comfortable. 

Mr. Oberstar. And you felt you needed some personal, profes- 
sional protection? 

Mr. Lauer. Yes, sir. 

Mr. Oberstar. In the form of insurance? 

Mr. Lauer. Yes, sir. 

Mr. Oberstar. You also said, when Eclipse presented to FAA the 
second aircraft for airworthiness certification, you found that in- 
spectors had not inspected a number of critical areas and may have 
violated Federal aviation regulations, with apparently false state- 
ments on the forms. Can you elaborate on that? 

Mr. Lauer. Yes, sir. The application form for airworthiness cer- 
tificate contains a certifying statement above where the applicant 
signs. In essence it says the airplane has been inspected, it con- 
forms to its type certificate and it is in a condition for safe oper- 
ation. 

Mr. Oberstar. Well, and earlier you said that when FAA inspec- 
tors told Eclipse something they weren't particularly happy about 
hearing, their answer was, they can't live with it, the issue would 
be elevated to Washington. What did they mean about that? 

Mr. Lauer. Yes, sir. The inspectors began to hear that quite 
often from the Eclipse, I suppose it is mid-management level people 
that were actually out on the floor, overseeing, trying to get these 
aircraft processed. They wouldn't hesitate to pull that card, if the 
inspectors were asking to see too much, requiring too much, docu- 
menting too many things wrong. 

Mr. Oberstar. And that was probably said with an intimidating 
tone or with an implication that your judgment would be bypassed? 

Mr. Lauer. Yes, sir. 

Mr. Oberstar. That is not a safety-compliant attitude, in my 
judgment. 

Mr. Lauer. No, sir. Like I said in my statement, I perceived 
there was heavy, heavy management pressure from Eclipse man- 
agement to those people in the company to get those airplanes out 
the door. 

Mr. Oberstar. And apparently, a relationship at some other 
level with Washington FAA personnel? 

Mr. Lauer. I was never privy to what went on at higher levels, 
sir. 

Mr. Oberstar. By Washington, you have to be in headquarters 
FAA. 

Mr. Lauer. Yes, sir. 

Mr. Oberstar. Well, Mr. Chairman, there area number of these 
matters that we could pursue. I just want one more with Mr. 
Di Paolo. You said that you spoke to one of the certification engi- 
neers on September 29th, 2006 and you were told FAA was not 
going to sign off on the type certification of the Eclipse. Yet on a 
Saturday, that sign-off occurred. Flow did that happen? 
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Mr. Di Paolo. You are asking me to interpret what the FAA 
managers were trying to do, and the oniy thing i can think of again 
was the pressure that they seif-perceived about trying to get this 
airpiane approved by the end of the fiscai year, that somehow that 
was iinked to their performance pians. There is aiso another docu- 
ment caiied the partnership for safety pi an that aiso tries to hand- 
cuff the engineers and force them to meet these time iimits. These 
are documents that need to be reviewed by the Committee and pos- 
sibiy removed from the FAA's poiicy. They are not mandatory docu- 
ments. They shouid not have a roie in when we certify an airpiane. 

Mr. Oberstar. it seems to me this process was driven by some- 
thing other than safety within the FAA. 

Mr. Di Paolo, i agree with you, sir. 

Mr. Oberstar. We wiii continue to probe to get to the bottom of 
that. Thank you very much, Mr. Chairman. 

Mr. Costello. Thank you. 

Ms. Broyies, you were present, your testimony indicates you were 
present when Mr. Wojnar toid a team that in other words, "we oniy 
need to go an inch deep when evaiuating the quaiity system," is 
that correct? 

Ms. Broyles. Yes, sir. 

Mr. Costello, in your years of experience, have you ever been 
toid such a thing before by a senior FAA manager? 

Ms. Broyles. Never. 

Mr. Costello. You aiso said that you consider yourseif a very 
thorough auditor, and after you were toid to iook no more than an 
inch deep, you went back again and found numerous discrepancies 
that had aiready been sign^ off on by Edipse FAA-designated in- 
spectors, is that correct? 

Ms. Broyles. Yes, sir. 

Mr. Costello. And you were toid by an empioyeeof Edipse, who 
i beiieve you say was your escort, that you were 'looking more than 
an inch deep"? 

Ms. Broyles. Yes, sir. 

Mr. Costello. Fiow did you take that? Fiow do you think the 
Edipse empioyee knew what FAA empioyees were toid in an ear- 
iier meeting? 

Ms. Broyles, i reaiiy don't know how they found out what was 
toid to us in an FAA internai meeting, i don't know how they got 
that information. But i was surprised when he said that to me, be- 
cause i do tend to go more than an inch deep. Quite a bit more. 

Mr. Costello, i have other questions that we wiii submit in 
writing to you, to members of the panei. i wouid ask if there are 
any other questions by the Ranking Member, Mr. Petri, at this 
time. Mr. Petri wiii have questions submitted in writing. 

Mr. Bosweii, do you have further questions at this time? 

Mr. Boswell. No, thank you, Mr. Chairman. 

Mr. Costello. The Chair thanks you. And iet me say, reiterate 
what Mr. Oberstar said, we thank you for not oniy your testimony 
today but for your courage in coming here to teii us things that we 
need to know about what is going on with the FAA. And i aiso 
want you to know this, those of you who are stiii empioyed at the 
FAA, that i want to hear from you if in fact there is any retaiiation 
at aii. if there is any indication from empioyees or management at 
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the FAA, any retribution from your testimony here, I personally 
want to know about it. There are protections in place where we 
should and can protect you. 

It is a valuable tool for us in conducting our oversight. I don't 
know if you were in the room earlier when I said a situation that 
resulted in nine deaths in my Congressional district was only dis- 
covered and revealed when employees came forward. Management 
wouldn't listen to them. But once we got the inspector general in- 
volved and others, it was determined that it was substandard care 
on their part. But it originated with current employees at that fa- 
cility. But for their courage in coming forward to give us the infor- 
mation that we needed, we would not have been able to do some 
of the things we have just done to put other management teams 
in place and to begin to try and deal with the families and to com- 
pensate them for their loss. 

So again, we thank you for your courage. We thank you for your 
testimony, and at this time, this panel is dismissed. Thank you. 

The Chair will now introduce panel three as they are coming for- 
ward. They will take their respective places. Mr. Nicholas Sabatini, 
who has testified before this Subcommittee several times, the Asso- 
ciate Administrator for Aviation Safety at the FAA. Mr. J ohn J . 
Flickey, the Director of Aircraft Certification Service for the FAA. 
Mr. Ronald Wojnar, Senior Advisor, Aircraft Maintenance Division, 
Aircraft Certification Services at the FAA. And Mr. Tom Flaueter, 
Director, Office of Aviation Safety, National Transportation Safety 
Board. 

Mr. Sabatini, my understanding is that you will be offering testi- 
mony. Are there others from the FAA that will offer testimony or 
will they only be there to answer questions? 

In fairness to you, we allowed the Inspector General additional 
time and waived the five minute rule for him. The last panel, we 
kept them to five minutes. But in fairness to you, I think the In- 
spector General took about ten minutes and we certainly will be 
considerate of your time. Please, if you feel you need more than five 
minutes, please feel free to take that time. 

TESTIMONY OF NICHOLAS J . SABATINI, ASSOCIATE ADMINIS- 
TRATOR FOR SAFETY, FEDERAL AVIATION ADMINISTRA- 
TION, ACCOMPANIED BY J OHN J . HICKEY, DIRECTOR, AIR- 
CRAFT CERTIFICATION SERVICE, AND RONALD WOJNAR, 
SENIOR ADVISOR, AIRCRAFT MAINTENANCE DIVISION, AIR- 
CRAFT CERTIFICATION SERVICE; TOM HAUETER, DIREC- 
TOR, OFFICE OF AVIATION SAFETY, NATIONAL TRANSPOR- 
TATION SAFETY BOARD 

Mr. Sabatini. Thank you, Mr. Chairman. I do appreciate that. 
M ay I proceed? 

Thank you. Chairman Costello, Chairman Petri, Members of the 
Subcommittee, thank you for the opportunity to appear before you 
today on behalf of the FAA to discuss the certification of the 
Eclipse EA-500. With me today isj ohn Flickey, Director of Aircraft 
Certification Service, and Ron Wojnar, a Senior Advisor in the 
Flight Standards Service. We have one submitted written state- 
ment and I will be summarizing our remarks for all three of us this 
morning. 
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With any major projects like Eclipse, there are really two stories. 
One is the technical story and the other is the human story. My 
written statement goes into great detail on the technical story, so 
I will not take this time to restate those issues. Rather, I would 
like to focus my remarks on the human story, because peoples' per- 
ceptions are important, and they certainly played a role in what 
you have heard today. 

To state the obvious, the certification of an aircraft is an ex- 
tremely complex process. No aircraft obtains certification without a 
great deal of trial and error, and the Eclipse aircraft was certainly 
no different in that respect. We encountered many, many problems 
throughout the process. But we worked them through to achieve 
resolution. Was it a perfect, painless process? Absolutely not. There 
is no such thing. 

But the bottom line is, I believe that the aircraft was properly 
certified. I believe that the aircraft meets FAA safety standards 
and I have the results from a special certification review team to 
back me up on that. What I want to address head-on are the alle- 
gations that we have heard here today that management at the 
FAA unduly pressured our regional certification teams. Was there 
undue or improper pressure? I would have to say no. Was there 
any kind of pressure at all? I would have to say yes. In every job, 
in every project, with every deadline, there is pressure. There is 
pressure to do the job safely, to do it right and to do it on time. 

So what did happen? What kind of pressure was there? There 
was pressure to follow the laws and the regulations governing the 
FAA. There was pressure to meet our standards. There was pres- 
sure to follow our national guidelines and policies. There was pres- 
sure to meet an agreed-to time line. And when management at 
headquarters had reason to believe that these obligations were not 
being met, Mr. Flickey took the appropriate steps to determine the 
best way forward to meet our obligations. 

This Committee has rightfully criticized FAA management for 
not intervening when it should have. This was not such a case. 
When the officials in charge of establishing and implementing na- 
tional policy for engineering overruled a local office on how the air- 
craft could be type certified, were some people unhappy with that 
decision? When Mr. Wojnar was sent in with a team to refocus the 
efforts for Eclipse to obtain a production certificate, were some on 
the local team troubled? Were people genuinely upset and con- 
cerned at various points during this process? 

Obviously, you have just heard from some of them. And I regret 
that they felt devalued, because I respect every employee working 
in aviation safety. I know that they are just as committed to safety 
as I am. But leadership is often about making difficult decisions 
when necessary. It is about protecting your people when you can 
and calling on them to do better when you must. Pressure to work 
harder or be more creative or more responsive is not a bad thing. 

I truly regret if that pressure was interpreted as a direction to 
do anything other than follow applicable laws, regulations and es- 
tablished policies. I appreciate that the witnesses we have heard 
from believe that headquarters' involvement was inappropriate or 
resulted in a less than thorough process. But I also know there are 
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other individuals who would not agree with that assessment. They 
just weren't asked to testify today. 

I am not going to defend every action and decision in the very 
long and complicated certification of the Eclipse aircraft and the 
subsequent issuance of the production certificate, because I know 
there could have been better communication and documentation 
with respect to some of the disputed issues. The SCR noted those 
deficiencies and made some recommendations. But their rec- 
ommendations were not revelations to us. We know there is always 
room for improvement and we are already working on how we can 
use the lessons learned from the Eclipse certification to make the 
certification process better. 

Mr. Chairman, we have heard a lot of things here today. We 
have heard a lot of allegations of undue pressure, of potential safe- 
ty problems, of very human failures to communicate effectively. As 
I watched the testimony of the other witnesses in the other room, 
however, I am more convinced than ever that we have a dedicated 
workforce that only wants safety to improve. In that, we are in 
complete agreement. 

Mr. Chairman, Congressman Petri, Members of the Sub- 
committee, thank you for your time and for inviting us here to tes- 
tify. Mr. Hickey, Mr. Wojnar and I are happy to answer any of your 
questions. 

Mr. Costello. I do want you to know, Mr. Sabatini, that I did 
hear your testimony in the adjoining room. 

Mr. Sabatini. Thank you, sir. 

Mr. Costello. I have a number of questions to ask, obviously, 
but let me give you an opportunity to expand on your testimony. 
You submitted your written testimony in advance, before you 
heard 

Mr. Petri. Is Mr. Haueter going to give an opening statement? 

Mr. Costello. No other opening statements, is that correct? 

Mr. Sabatini. No, sir. 

Mr. Costello. Mr. Haueter, do you have testimony to present? 
I am sorry. Mr. Haueter is now recognized, and we will come back 
to you in a few minutes, Nick. 

Mr. Haueter. Thank you, sir. 

Chairman Costello, Ranking Member Petri and Members of the 
Committee, thank you for allowing me the opportunity to present 
testimony on behalf of the National Transportation Safety Board 
regarding the Eclipse 500 airplane. It is a privilege to represent an 
agency that is dedicated to safety of the traveling public. 

Although the Safety Board is not involved in aircraft certification 
and manufacturing processes, the Board strives to improve aviation 
safety through detailed investigations and subsequent rec- 
ommendations. To date, the Board has conducted investigations of 
two accidents and three incidents involving Eclipse 500 airplanes. 
Four of these events occurred since April 2008 and are still ongoing 
investigations. 

As a result of an event on j une 5th, 2008, at Chicago Midway 
Airport, the Safety Board issued two urgent safety recommenda- 
tions to the Federal Aviation Administration regarding the Eclipse 
500. In that event, the pilot reported that when crossing the run- 
way threshold for landing the airplane encountered a wind shear 
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and developed a high sink rate. The pilot arrested the sink rate by 
moving both thrust levers to the maximum power position. After 
touchdown, the pilot found that the airplane was accelerating, al- 
though the thrust levers were at idle. Because the airplane was 
rapidly approaching the end of the runway and could not be 
slowed, the pilot decided to abort the landing. 

During the climb-out, the pilots found that the thrust lever posi- 
tions had no effect on engine thrust, and noted that the airplane's 
crew alerting system displayed that both the left and right engine 
full authority digital electronic controls, or FADECs, had failed. 
The pilots referenced the airplane's quick reference handbook on 
emergency procedures for engine control failure, which contained 
instructions for a single engine control failure, but not for a dual 
engine control failure. 

The procedures advised that when one engine control failed, its 
respective engine should be shut down. In order to reduce the air- 
speed, the pilots shut down the right engine. However, shortly 
thereafter, they noted the left engine was idle and would not re- 
spond to thrust lever commands. Fortunately, the airplane had suf- 
ficient altitude to reach the runway for a successful landing. With- 
out the resourcefulness of the pilots, the visual meteorological con- 
ditions that prevailed at the time, and the airplane's proximity to 
the airport, the successful completion of this flight would have been 
unlikely. 

The findings of the investigation indicate that when the pilot ad- 
vanced the thrust levers to the maximum power stops, it is likely 
that the thrust levers exceeded the normal maximum position 
which resulted in a dual channel failure in both thrust lever sys- 
tems. Then because of program illogic in the FADEC software, the 
engines maintained the thrust level of the last valid thrust lever 
position. In this case, that position was or nearly at maximum 
power. 

When the flight crew shut down the right engine, the fault code 
for the engine cleared. However, because FADECs software was 
programme so that the left engine would mirror the thrust lever 
position of the no-fault right engine, which was positioned at idle 
after shut-down, power in the left engine was reduced to idle. Thus, 
the pilots were flying with one engine that was shut down and an- 
other engine that would not advance past idle. 

On J une 12th, one week after the incident, the Safety Board 
issued two urgent safety recommendations to the FAA. The first 
safety recommendation asked the FAA to require an immediate in- 
spection of all Eclipse 500 airplane throttle quadrants to ensure 
that pushing the throttle levers against the maximum power stops 
would not result in an engine control failure and to require that 
any engines that failed the inspection be replaced. 

On the same day, the FAA issued an airworthiness directive to 
require Eclipse pilots to evaluate the throttle quadrants to see if 
a throttle fault could occur. The Eclipse has since developed an 
FAA-approved test procedure and issued an alert service bulletin 
that provided standardized procedures for testing the thrust levers. 
On August 2008, the FAA superseded its original airworthiness di- 
rective to mandate the Eclipse alert service bulletin which was to 
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be accomplished by a person who was authorized to perform main- 
tenance. 

The Safety Board's second urgent safety recommendation asked 
the FAA to require Eclipse to immediately develop an emergency 
procedure for dual engine control failure and to incorporate the 
procedure into the airplane flight manual and quick reference 
handbook. Eclipse developed the emergency procedures for dual en- 
gine control failure and the FAA issued an airworthiness directive 
to incorporate these procedures into the flight manual and a quick 
reference handbook. 

Additionally, Eclipse reprogrammed the FADEC logic to limit the 
thrust lever out of range angle and not make it a hard fault, so 
that when the thrust levers retarded below the angled range, the 
FADECs would resume reading the thrust lever position. 

This concludes my prepared statement and I am happy to answer 
any questions. 

Mr. Costello. Thank you, Mr. Flaueter. 

Mr. Sabatini, you submitted your written testimony prior to your 
appearance here. You heard the witnesses testify on the previous 
panels, the IG and the former FAA employee and current employ- 
ees. I wonder, is there anything that you want to add to the testi- 
mony that you submitted to the Committee based upon what you 
have heard? I have specific questions, but I want to give you the 
opportunity. These are some very serious allegations that have 
been made about a date and a calendar driving the project. You 
have heard the testimony. I don't need to go over it, but I will get 
into specifics. Any statement you would like to make? 

Mr. Sabatini. Well, let me begin by saying that the office man- 
ager who issued the type certificate stands by her decision back 
then that the aircraft met all applicable Federal aviation regula- 
tions. Secondly, we had a special certification review team that fol- 
lowed up, and these are people who are world renowned, respected 
in their own right, competent and qualified to make their own deci- 
sions, who have reviewed the data that was submitted for type cer- 
tification, laboratory work, et cetera, and have determine inde- 
pendently that this aircraft is safe and has met the applicable Fed- 
eral aviation regulations to be issued type certificates. 

I would also add, as I mentioned in my oral statement, there is 
much to be learned here in terms of the process. We are going to 
continue to improve that process. We take the recommendations 
that have been made by the IG and the special certification review 
team. A number of those recommendations were already underway. 
And we take it very seriously. I want to emphasize once again, 
there is no question in my mind or in the question of anyone in 
my organization or in the FAA that we work for the public. What 
we do is on behalf of the public. What we do is assure the safest 
possible system. And the safety data that we have today shows 
that we are living in unprecedented times. We are at the safest pe- 
riod ever with respect to both commercial aviation and general 
aviation. 

Mr. Costello. We are indeed, and that is where we want to re- 
main. That is one of the reasons why we take our oversight respon- 
sibilities very seriously with this Subcommittee. 
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You said there are things that we have learned here, meaning 
that the FAA has learned in the process, is that correct? 

Mr. Sabatini. Yes, sir. 

Mr. Costello. What are some of the things that you have 
learned and that you would do differently in the future? 

Mr. Sabatini. Well, as the Inspector General mentioned, while 
FAR Part 23 is the appropriate regulation to apply to airplanes of 
this nature, given the advancing technology, we recognize that we 
want to improve that regulation to put specific requirements in 
there for airplanes like the VLJ . 

I would also add that in the circumstances we have today, where 
the regulation has not yet been promulgated, there are tools that 
we can use and have used which are called special conditions. They 
call for special requirements that particular product, that par- 
ticular technology must meet before we allow it to be certified. 

Again, we are looking at the structure of the Aircraft Certifi- 
cation Organization, determining whether or not that structure is 
proper for today's environment and making certain that we provide 
the appropriate resources when faced with new technology such as 
the Eclipse. 

Mr. Costello. As you heard the testimony and you are very 
much aware that the production certification was approved with 13 
outstanding deficiencies as was identified by the I nspector General, 
and it took a better part of the year after the approval was given 
to get these corrected. In retrospect, in the future, would you do 
that differently? 

Would you issue the production certification with these out- 
standing issues to be addressed with an lOU to say we are giving 
you a production certification and we will let you go forward and, 
at a later date, correct these or address these issues? 

Mr. Sabatini. Well, certainly we always learn from past experi- 
ences, for one. 

Mr. Costello. Flave we learned from this experience? 

Mr. Sabatini. We certainly have, sir. The production certificate 
regulation is very broad in nature, and what was done was within 
the confines of what the particular rules allow. 

I would like to ask Mr. Ron Wqjnar to further elaborate on those 
13 issues because it is — I wouldn't say misrepresented — but there 
needs to be better understanding of what is being said here about 
13 outstanding. Those issues were already identified and were in 
various stages of revision, which is not uncommon. 

So I would like to ask Mr. Wqjnar, with your permission, to con- 
tinue and expand on that. 

Mr. Costello. Let me ask Mr. Wqjnar the question then before 
he explains. 

Knowing what you know now, would you go forward with the 
production certification with those 13 outstanding deficiencies 
pending, knowing that it took up to a year and in some cases over 
a year to address those deficiencies? 

Mr. Woj NAR. Mr. Chairman, I think we have learned from the 
increased scrutiny that we need to reconsider how we do that. 

Mr. Costello. Is that a yes, that you have learned from that 
and that you would not allow certification with these 13 defi- 
ciencies in the future? 
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Mr. Woj NAR. Well, it depends. We don't really look at them as 
deficiencies. The basic regulations were met. The production certifi- 
cation Board determined that the basic requirements were met. 

Mr. Costello. So same case scenario happens a month from now 
or six months from now, the same 13 items are identified that need 
to be addressed, you would still go forward with the production cer- 
tification? 

Mr. Woj NAR. I think we would improve our internal communica- 
tions and decision-making. 

Mr. Costello. Is it a yes or a no? 

Mr. Woj nar. Yes. 

Mr. Costello. I mean we can dance around all day, but there 
are answers that we need to have. 

Mr. Woj nar. Yes. 

Mr. Costello. Either it is a yes or a no. 

Mr. Woj nar. Mr. Chairman, it is yes. 

Mr. Costello. So you would give the production certificate in 
the future with these types of deficiencies. 

Let me ask another question. There were 11 of these planes that 
Eclipse was permitted to go forward and deliver to their customers 
with deficiencies and lOUs outstanding. 

Mr. Woj nar. No, sir. 

Mr. Costello. There were not, okay. 

The IG in his testimony indicates that 11 planes were delivered 
to their customers, and we have letters in exchange between the 
FAA and Eclipse on this issue, and you are saying that that is not 
true? 

Mr. Woj nar. The 11 aircraft that were delivered prior to produc- 
tion certification conformed to all the FAA-approved data. The FAA 
inspectors ensured that they did. While I believe there maybe were 
some software revisions that were incorporated after the airworthi- 
ness certification, at the time of the airworthiness certification of 
all of those 11 airplanes, they definitely conformed to all the FAA- 
approved design data. 

Mr. Costello. Well, I would just refer you to the IG's testimony. 

Mr. Sabatini, you have a comment? 

Mr. Sabatini. Yes, sir, Mr. Chairman. What we know to be fac- 
tual is that the office manager of the Fort Worth office that issued 
the type certificate issued it on the basis that that aircraft met the 
applicable regulations at that point in time. 

We also know that the special certification review team reviewed 
the data, competent in their own right to do that, well qualified to 
do that, and made the same determination. 

This lOU that exists is not cogent to the issue. It has no bearing 
on having issued theTC. That is an important distinction. It was 
an agreement that had no bearing on the issuance of the type cer- 
tificate that was validated by the special certification review team. 

Mr. Costello. And the issue of the avionics not being certified 
at that time on the 11 aircraft, address that if you will. 

Mr. Sabatini. Well, those 11 aircraft were evaluated against the 
type certificate that was issued. That is the position of the office 
manager as well as the special certification review team. The air- 
craft met the requirements and the applicable regulations. 
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And, sir, there is an area of confusion that I would like to ad- 
dress if I may. The regulation that addresses the certification of an 
aircraft is FAR Part 21.305, and it provides options for certifi- 
cation, not alternate means or equivalent levels of safety. 

It provides options of how you may proceed with the certification 
of that product, one of which is type certification, which is very 
widely used and very common. Another alternative is a TSO. An- 
other is under a parts manufacturing approval basis or any other 
means approved by the Administrator. 

The certification process began for the avionics under a TSO. It 
is perfectly fine and within the regulations to finalize certification 
using the type certificate option. It is already in the law and should 
not to be construed as an alternate means. It is a means that a 
manufacturer can choose to opt for. 

Mr. Costello. You heard the Inspector General's testimony, and 
again there are several other questions we are going to get to, 
about the lOUs. You are saying that is common practice, and it is 
really no big deal. 

Mr. Sabatini. Well, let me say that for this particular project, 
the agreement that was made had no bearing on whether or not 
the type certificate was ready to be issued. The team that reviewed 
what we did determined that the aircraft was ready for type certifi- 
cation, that agreement notwithstanding. 

The office manager who signed that agreement will also tell you, 
which interestingly enough she has not been called to testify, will 
tell you that she made her decision on type certificate issuance on 
the basis of having met all applicable r^ulations. 

Mr. Costello. You heard the previous testimony by the prior 
panel, and I just wonder what your comments are concerning Ms. 
Broyles where she says, Mr. Wojnar, that you told a team of people 
that were called into a meeting that, in other words, we only need 
to go an inch deep when evaluating the quality system. Is that a 
true statement by Ms. Broyles? 

Mr. Wojnar. I don't believe it is a true statement, Mr. Chair- 
man. I don't believe I have ever said that. I don't. I know it doesn't 
match FAA policy. It doesn't match my own philosophy. 

I even check^ in with some of the other people who were 
present in the room that day, and they assured me that I never 
said that. 

Mr. Costello. So where do you think she got this impression 
that she said you should only look an inch deep and later that her 
Eclipse escort said "you are looking more than an inch deep?" 

Mr. Woj NAR. That is a mystery to me, Mr. Chairman. 

I do remember talking about the context of the production certifi- 
cation Board audit. I am sure I did mention that we had to make 
a decision. The company had been audited numerous times, and 
this was an audit to make a decision and to draw a conclusion. I 
said that we were going to do a comprehensive audit and spot 
check to make decisions that week. 

So there may have been some misunderstanding. 

Mr. Costello. It is a major misunderstanding, I would say, if 
she had the impression that you told her to only look an inch deep, 
and then an employee of Eclipse who escorted her said "you are 
looking more than an inch deep." 
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That is your testimony for the record, is that right? 

Mr. Woj NAR. That is correct, Mr. Chairman, and that makes me 
think maybe that came from somewhere else other than me be- 
cause Eclipse was not with us at that meeting. 

Mr. Costello. Well, she didn't testify that they were with you 
at the meeting. That was a mystery to her. That was her testi- 
mony. 

She said that at the meeting you made the statement, you should 
only look an inch deep. Later, the Eclipse escort told her that she 
was looking "more than inch deep." 

But that is your testimony for the record? 

Mr. Woj nar. Yes, sir. 

Mr. Costello. I have other questions, but at this time the Chair 
will recognize the Ranking Member, Mr. Petri. 

Mr. Petri. Thank you very much, Mr. Chairman. 

I feel a small obligation to ask Mr. Hickey. Your name has been 
mentioned a number of times, and you clearly have a lot of respon- 
sibility and are key player in this whole process. If you could just 
give us your view of the Eclipse certification, the kind of pressures 
or deadlines or how you managed this process from your point of 
view. 

Mr. Hickey. I would be happy to do that, Mr. Petri. 

The Eclipse program was one of very high visibility. It , but not 
unlike what we see in other areas outside of Fort Worth. Boeing 
programs are always highly visible. Engine programs like the 
Cenex that serve on Boeing airplanes are also high visibility. 

What was unique about this was that it was a highly visible pro- 
gram for an office that was unaccustomed to high visibility pro- 
grams. 

The program had worked its way through the process. It was cer- 
tainly a long program. As we said earlier, it lasted five years, two 
years longer than a normal program of that size. 

At the tail end of the program, when the process that had pre- 
viously been set where the avionics company was seeking one ap- 
proval, its TSO approval for its avionics software, it was learnt 
by the company, the airplane company. Eclipse, that the avionics 
would not get a TSO approval in time. Eclipse made a decision to 
invoke a regulatory provision in Part 21 to approve the software in 
a different way. 

It is incorrect to make statements that FAA suddenly allowed 
the approval of the software that was different from the industry 
standard. That is an incorrect statement. 

The industry standard, D0-178B, is not required to be met in its 
entirety if the product is certified and approved under the type cer- 
tificate. 

In mid-September, Eclipse offered a proposal of how to approve 
the software to the FAA team. The FAA team disagreed with that 
approach and, because the deadline or the milestones set for certifi- 
cation were September 30th, I was asked to get involved. 

At this point, I think it is very important to stress that the date 
of September 30th was not a date set by the FAA. The date of Sep- 
tember 30th was a date set by the company. 

In almost every program I have ever been involved in, all dates 
are set by the company, not by the FAA. They propose the dates. 
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The FAA reviews the schedules and the things that lead up to that 
date and make determinations about whether or not they can meet 
the dates. I n many, many cases, the date is never met. 

In fact, a previous goal was, in fact, September 22nd. The goal 
of September 22nd was not met. 

When I went down to Albuquerque, I brought with me the divi- 
sion manager with responsibility for the national policy for the ap- 
plicable requirements for avionics software. During the meeting 
that we attended, it was decided that D0-178B was not required for 
certification. 

A different set of requirements was set. It was agreed to by the 
team, including one of the members of the previous panel. The 
company proceeded to go ahead and show compliance to those re- 
quirements. 

On the date of September 30th, the FAA team made two deter- 
minations. They determined the Eclipse 500 had complied with all 
the appropriate regulations and that it was in a condition for safe 
operation. In accordance with Part 21, when those two provisions 
are shown, the applicant is entitled to a type certificate. 

As a consequence, the manager of the office signed the TC and 
issued it to the company. 

Mr. Petri. My time is expired, but I just have one follow-up after 
you have gone through this. There was an independent Special 
Certificate Review Team appointed. Was that because questions 
were raised about this internally and externally or why was it? 

You don't have a review of every certification. So could you ex- 
plain why you did that and what the conclusions, who was on that 
and what their conclusions were after reviewing? I assume they 
were professional, qualified people who had the vision of hindsight 
and of the criticism and reviewed what you did. 

Could you discuss the briefly? 

Mr. FIickey. Yes, Mr. Petri. 

First of all, we do have a provision in the certification processes 
that do allow for what we call a Special Certification Review. We 
invoke it from time to time. If I were to guess, I would say we use 
an SCR maybe every five years. We do it when the compliance of 
a certain aspect of the airplane comes into question. 

Most recently, I think an SLR looked at the MU-2. We did a Spe- 
cial Certification Review of that. 

We did several Special Certification Reviews of the 737 airplane 
back in the nineties when we were experiencing rudder issues asso- 
ciated with 2 accidents. 

So it is clearly a provision I have at my disposal, and I can in- 
voke it when necessary. 

As a result of the allegations associated with the Eclipse, we de- 
cided it was best to call together a Special Certification Review to 
evaluate the specific areas being alleged by the witnesses that were 
alleged to be non-compliant at the time of the type certificate. 

Because of my involvement as director, I stepped out of that 
process. Mr. Sabatini, Associate Administrator, took responsibility 
for setting up the team. They created a team of some of the best 
and brightest specialists in my service. I can't emphasize enough 
that these people are the best. They also share that they had noth- 
ing to do with the original Eclipse type certification. 
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They decided to head the team by someone outside the FAA, and 
they tapped a person named J erry Mack who was a well -respected 
safety expert. He has been in the business for many, many years, 
and worked at Boeing. So, he came in with the team and conducted 
a 30-day review in the areas of the allegations. 

That team made two findings, that the airplane in the areas of 
the allegation were, in fact, compliant at the time of the issuance 
of the type certificate, and that the airplane is currently safe. 

Mr. Costello. Let me clarify a couple of points here. Your testi- 
mony is that the manufacturer set the date of September, 2006, is 
that correct? 

Mr. Hickey. That is correct. 

Mr. Costello. The date was not a date that was established by 
the FAA, that is correct? 

Mr. Hickey. That is correct. 

Mr. Costello. Your Annual Performance Plan shows the date of 
September, 2006 in the FAA's Annual Performance Plan, is that 
correct? 

Mr. Hickey. That is correct. 

Mr. Costello. This is customary practice, the manufacturer tells 
the FAA, this is when we are going to have you certify either the 
design or the production, and you put in your plan to work off of 
what the manufacturer desires? 

Mr. Hickey. Well, to be honest with you, Mr. Chairman, the fact 
that my performance plan called for September 30th was irrelevant 
to the fact that Eclipse had ultimately set September 30th, and I 
will explain why. 

When we set our business goals for, in this case, fiscal year 2006, 
they are set very early, well before fiscal year 2006. We knew we 
had three programs that were in the running for certification as a 
VLJ . In my business plan, I was going to select one VLJ and use 
that as my goal and my objective to satisfy my boss. That that was 
what I was going to accomplish that year. 

I typically set the end of the fiscal year to give me enough flexi- 
bility because I don't control the certification of these programs. 

Mr. Costello. I understand the point. 

Let me ask you then, so it is your testimony and Mr. Sabatini's 
testimony and Mr. Wqjnar's testimony that the calendar did not 
drive this project at all. 

Mr. Hickey. No, I don't think I am saying that. 

The calendar was set by the company. The FAA agreed to that 
date. That is a normal process. 

Mr. Costello. You heard the testimony of some of the current 
FAA employees who worked on the project, and their testimony is 
that corners were cut and things were overlooked in order to meet 
the deadline of certification of September, 2006. You heard that 
testimony. 

Mr. Hickey. I did, sir, and I think I understand how you can 
draw that conclusion. But I think if you also looked at a previous 
deadline of September 22nd, corners were not cut to meet Sep- 
tember 22nd. 

Mr. Costello. How many times has the FAA issued a certifi- 
cation on a Saturday afternoon? 
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Mr. Hickey. I don't have that figure, but I will tell you it has 
happened before. 

Mr. Costello. It has happened before? 

Mr. Hickey. Yes, it has. 

Mr. Costello. I would like to have that information given to the 
Subcommittee. 

Mr. Hickey. I will provide that for the record. 

Mr. Costello. Mr. Hickey, since we are on a line of questioning 
here, let me ask you, you have heard from two different witnesses 
who sat at the same table, who testified under oath that you con- 
vened a meeting a few weeks before theTC was approved and that 
you made the statement: we are here to save a company. 

Is that an accurate statement? Did you make that statement in 
the meeting with these employees that they attended? 

Mr. Hickey. No, Mr. Chairman, I did not make that statement. 

Mr. Costello. You didn't. So they just pulled this out of the thin 
air? 

Mr. Hickey. I can't tell you where they got that, sir. 

Mr. Costello. Okay. You also heard testimony from employees 
of the FAA under oath who said that they were reassigned. I would 
like you to address that, why you took the management team out, 
put a new team in and a new manager in. 

Mr. Hickey. Yes, sir. First of all, I only removed one person in 
the whole process. I removed no one during the type certification 
process. 

It was during the production certification process when I became 
aware of behavior, procedures and practices that some of my in- 
spectors were following that felt very strongly were inappropriate 
for the conduct of FAA people that individuals were removed. 

As a result of that and as a result of the previous issues I had 
with the directorate manager during the type certification process, 
I concluded to myself that I had lost confidence in the senior execu- 
tive management of that office. And when I lost confidence, I 
couldn't accept the continuation of that program in that office until 
I had some level of confidence in the executive leadership. 

Mr. Costello. Explain what led you to lose confidence in the ex- 
ecutive leadership. 

Mr. Hickey. During the type certification process, sir, I saw a 
number of cases, including the software case in mid-September, 
where I found the directorate manager insufficiently engaged in 
the program, so that when issues would arise like the software 
issue, I found that person very much in tune with his own office's 
position. He but had virtually no contact with the applicant's posi- 
tion to understand and evaluate what was the right resolution on 
an issue. 

I am a firm believer that when we engage in certification, it is 
very important to understand both sides of a technical issue. I 
didn't find him adequately involved in doing that. 

Mr. Costello. Let me ask, this is the Inspector General's testi- 
mony. He says: "FAA Headquarters officials also removed the Di- 
rectorate Manager in charge of both the manufacturing inspection 
and design certification offices from the Eclipse project." 

That was a decision that you made? 

Mr. Hickey. Can I ask you to repeat that, sir? 
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Mr. Costello. It says: "FAA Headquarters officials also removed 
the Directorate Manager in charge of both the manufacturing in- 
spection and design certification offices from the Eclipse project." 

Mr. Hickey. That is not totally correct. 

Mr. Costello. It is not? 

Mr. Hickey. It is not. 

Mr. Costello. It goes on to say: "In a six-page letter of rep- 
rimand, FAA officials stated that the Directorate Manager failed to 
meet expectations associated with meeting its 'customer service ini- 
tiatives.'" 

Specifically, the letter stated that he needed to "build relation- 
ships with our customers to achieve operational results." 

The letter further stated, "Your personal relationship with the 
Eclipse executives is deficient. As Eclipse is one of your major cus- 
tomers, we expect you to work to improve the relationship." 

You are not aware of the reprimand or any reference to telling 
the manager to develop this relationship with management at 
Eclipse? 

Mr. Hickey. I am well aware of the six-page document. 

Mr. Costello. You did say that, "meet expectations associated 
with meeting its customer service initiatives," and you also said 
that "your personal relationship with the Eclipse executives is defi- 
cient?" 

Mr. Hickey. The nature of the six-page performance conversa- 
tion, sir, is tied and correlates with the six qualities and skills that 
we have as an executive manager in the FAA. They are items like 
business acumen, and unfortunately today I guess customer is a 
bad name, but it was a terminology that we us^ at the time. 

If I might add, as an executive, it is important for an executive 
to understand technical issues which happen a lot in certification. 
There are disagreements. It is very important for an executive 
manager to understand the issues that the office has as well as the 
issues that are raised by the applicant. 

Mr. Costello. I have further questions, but I have taken more 
time than I should. 

The Chair will now recognize the gentleman from North Caro- 
lina, Mr. Hayes. 

Mr. Hayes. [Remarks off microphone.] 

Mr. Costello. Very good. The Chair would recognize the distin- 
guished Chairman of the Full Committee, Chairman Oberstar. 

Mr. Oberstar. I have been following your line of questioning 
while I was on Corps of Engineers business for the Committee in 
another room, meeting on other matters, and I think you have been 
pursuing a very appropriate and important line of inquiry. 

I want to come back to a few things and thank the witnesses for 
being here. 

The Inspector General testified— and you responded to this, but 
I want to hear it a little further— that the production certification 
was approved with 13 outstanding items identified as deficient. It 
took almost a year to get those corrected, and all that time the air- 
craft was being built and put into service. How can that be? 

Mr. Sabatini, how can that be? 

Mr. Sabatini. Well, as we said earlier. Chairman Oberstar, those 
deficiencies were identified early on. 
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A type certificate is issued once there is a demonstration of meet- 
ing the regulations. This is unlike a production certificate, which, 
when issued, goes into what we call continuous oversight or certifi- 
cate management. Our inspectors were engaged on an ongoing 
basis with assuring that progress was being made against those 13 
identified deficiencies. There were continuous checks on revisions 
that had to be made and other such things. 

So our folks, our inspectors, dedicated safety professionals were 
fully engaged with that manufacturer. 

Mr. Oberstar. Before the aircraft was put into service, were 
they cleaned up? Our information says that aircraft were put into 
services with those deficiencies in place. 

Mr. Sabatini. So the production certificate, the quality control 
system, the infrastructure, the people, the 13 issues that had been 
identified are against that particular issue as opposed to the air- 
frame itself. 

Those airplanes were being delivered in full compliance with the 
TC, and that was reaffirmed by the Special Review Team who con- 
cluded that the airplane met all applicable regulations and it was 
in condition for safe operation, sir. 

Mr. Oberstar. You maintain then that those 13 items identified 
as deficient were not safety of flight issues? 

Mr. Sabatini. Well, those were production certificate. 

Mr. Oberstar. The production certificate, not safety of flight 
issues. 

Mr. Sabatini. Right, and they didn't relate specifically and di- 
rectly to the airplane. 

Mr. Oberstar. So in the production process, you are saying that 
the manufacturer was adjusting, was complying with those, cor- 
recting those deficiencies? 

Mr. Sabatini. It is my understanding that they were, and I 
would like to ask Mr. Ron Wojnar, who is an expert in that area, 
as to the progress that was being made on those 13. 

Mr. Oberstar. Yes, go ahead. 

Mr. Woj NAR. If I may, Mr. Chairman, thank you. 

The production certification Board that convened to examine the 
company for its production certificate found that it met the two 
basic requirements in the rules: first of all, that Eclipse had estab- 
lished a quality system and, second, that it could maintain that 
quality control system. 

The 13 items, as Mr. Sabatini said, were identified in the course 
of final audit and earlier as items that we wanted to focus on. I 
would like to clarify that some of those 13 action items were not 
for the company or the company's quality system. 

A couple were for FAA follow-up. For example, we would expect 
the company to schedule for FAA to review its procedures in cer- 
tain areas, or check on revisions of existing procedures to improve 
them based on what FAA had seen in our previous evaluation. 
There would be an FAA follow up. 

The very last one of the thirteen items, was for the FAA to 
schedule a complete evaluation, periodic evaluation of the Eclipse 
quality system. That happens every 18 months or so. 

So those weren't really all quality control system deficiencies. 
They were action items that we wanted to preserve and manage as 
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we moved from the certificate issuance into the certificate manage- 
ment phase. Some were long-term, acceptable long-term actions. 

Mr. Oberstar. Well, the production certification is related to the 
ability to replicate the production of the article itself, the aircraft 
itself, and to assure that it can be replicated as they go through 
the production process. 

You are saying that you had no problems with their ability to 
replicate the production process, that these 13 items were not es- 
sential to that process. 

Mr. Woj NAR. That is correct. They were items we wanted to 
manage with the company, but we were assured that the airplanes 
that were being produced conformed to the approved design and 
were safe, and that is a separate process. 

The 13 actions were for the overall quality system and the FAA 
follow-up. 

Mr. Oberstar. How do you rate that system today? 

Mr. Woj NAR. Sir, I don't have that information. I haven't been 
involved with Eclipse since April 26 of 2007. So I have not been in- 
volved in the ongoing oversight. 

Mr. Oberstar. Mr. Sabatini, how do you rate the system today, 
the production? 

Mr. Sabatini. I would have to get back to you on that, Mr. Chair- 
man, since I don't have that information readily at hand. We have 
the local office that is responsible for that certificate. 

I am certain, given the attention that has been given to Eclipse, 
had there been issues, if Eclipse is not making progress, I certainly 
would like to have been informed. So, at this point in time, I will 
say I would like to get back to you. 

Mr. Oberstar. Well, we would like to have that information. 

Now, in April at our earlier hearing, we recommended that you 
amend the so-called Customer Service Initiative to avoid the ap- 
pearance of a conflict of interest with your safety mandate, and it 
is apparent that the FAA has not been making adjustments to the 
Customer Service I nitiative. 

Mr. Sabatini. Well, Mr. Chairman, I will tell you that I have 
personally visited every region and directorate and had audiences 
of hundreds of people, and I made it very clear that we work for 
the public, that what we do with the aviation community is on be- 
half of the public and that our first and most important mandate 
is safety. 

I have also put out highlights that go to every one of our employ- 
ees and restated once again that our customer is the public. 

Mr. Oberstar. Have you changed your fundamental document, 
the Customer Service Initiative, the written document itself? Have 
you changed that? 

Mr. Sabatini. That has not yet changed, sir. 

Mr. Oberstar. That is what I am referring to. 

Mr. Sabatini. That has not yet changed, sir, and we are taking 
steps to address that. 

Mr. Oberstar. You are going to do that? 

Mr. Sabatini. We are taking steps to address that, sir. 

Mr. Oberstar. Okay. In light of what we have been discussing, 

I won't ask you for a deadline, but when do you expect to publish 
a new document? 
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Mr. Sabatini. Can I get back to you on that, sir? 

Mr. Oberstar. Of course. 

Mr. Sabatini. Thank you. 

Mr. Oberstar. With great interest. 

Now we have come back to this issue of a deadline, a date set, 
a date specific. Why was a date specific set and why didn't the FAA 
in this case adhere to its longstanding principle that the aircraft 
is safe when you say it is safe, not when a date is met? 

Mr. Sabatini. Is that directed to me, sir? 

Mr. Oberstar. Of course. 

Mr. Sabatini. Okay. Several things, sir. There are many lessons 
learned here. For one, I would like to restate that date did not 
mean that, come hell or high water, we would just issue a type cer- 
tificate. We simply will not do that. 

The time line from the first three-year window that we had with 
Eclipse slipped to the right an additional two years. 

So let me say that we are going to review this process com- 
pletely, and we are going to change the way we do business to 
make it clear so that there isn't even the appearance that an 
agreed-to time line on how one can expect to have a product cer- 
tified is not misunderstood to mean that we will issue a certificate 
by that date. 

I can assure you, sir, that we will take every step necessary to 
adjust that so that we never have that appearance happen again. 

Mr. Oberstar. I am delighted to hear you say that. That is es- 
tablishing a spirit of compliance, oversight and of safety responsi- 
bility that I expect from the FAA and I expect from you. 

Mr. Sabatini. Yes, sir, and you have it. 

Mr. Oberstar. But how did that date come to be? Where did it 
come from? 

Mr. Sabatini. May I just provide a context and perspective, sir? 
It may take just a little bit of time. 

One of our goals is increased safety in our FAA Flight Plan. We 
know that over the many, many years that FAA has been in busi- 
ness, we have continuously improved the safety record. One of the 
goals is not only to improve on the commercial fatal accident rate 
but also in the general aviation accident rate. 

In that context, we recognize that industry is capable of pro- 
ducing new technology such as aircraft like a VLj , which tech- 
nically has no official standing or meaning. It is a term of art. 

We know that the introduction of turbine engines to a small air- 
craft like that will significantly improve safety because it has tre- 
mendous power, great climb performance, is able to fly higher than 
the weather, is the introduction of advanced integrated avionics, 
provides terrain avoidance capability, weather radar, and situa- 
tional awareness, all at the fingertips of a pilot who is well trained. 

Mr. Oberstar. That is great context. You are leading to your 
point to answer my question. 

Mr. Sabatini. Yes. The point is that we have a responsibility to 
allow new technology to come into the system so that we can con- 
tinue to improve on the general aviation safety record. 

If you go back in time, during that period when we were devel- 
oping our Flight Plan which is agency-wide with the very broad 
goals, there were 24 such airplanes in various stages of application 
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or ideas that were brought to our attention. The one that was most 
prominent at that time was the Eclipse because they seemed to be 
ahead of most other manufacturers. 

I n the Flight Plan, what we said is that we would type certificate 
a Very Light J et. We didn't name it at the high level nor at the 
AVS business level. 

J ohn chose to, being a good manager, say, well we are making 
great progress with this VLJ . It seems like a likely candidate. And, 
for that reason, he specifically identified it. 

But it was in the context of being a federal agency acting on be- 
half of the public, and assuring them that we could safely bring 
into being and into operation the best technology that we could pro- 
vide to the industry. 

Mr. Oberstar. So, in that context, you decided that a deadline 
had to be set by which time you would complete that certification? 

Mr. Sabatini. Well, if the manufacturer could complete the cer- 
tificate. 

Mr. Oberstar. So you are saying that date really came, sui ge- 
neris, from within the organization. 

Mr. Sabatini. Well, it came from the manufacturer who proposed 
that they could meet that date. 

Mr. Oberstar. The manufacturer proposed the date, not you. 

Mr. Sabatini. Yes, the manufacturer proposed it. 

Mr. Oberstar. And then you embraced that date and said, okay, 
that is the date by which we will complete our work. 

Mr. Sabatini. Yes, and it is dependent on us having the re- 
sources to do it. There is much that goes into agreeing to a time 
line. 

Mr. Hickey. Mr. Chairman, if I can add a couple items in terms 
of setting dates, all certification programs, almost without excep- 
tion, are set by the applicants' dates. History is littered with cases 
where they are never met. The dates are not met because they fail 
to provide the necessary information for the agency. 

Mr. Oberstar. In this case, you issued a provisional type certifi- 
cation by that date. 

Mr. Hickey. This was back in J uly that they were shooting for 
a full type certificate. They failed to provide the information nec- 
essary to get a full type certificate, so we issued a provisional type 
certificate. 

Mr. Oberstar. It seems to me that you shouldn't have issued a 
provisional. If the FAA stamp of approval means something, then 
it means you meet our standard. We are not giving you an lOU. 

Mr. Hickey. No. I am sorry, sir. A provisional is a very clearly 
delineated certificate in Part 21. It is not a secondary type certifi- 
cate. It is a certificate in its own right. It, historically, is often used 
for an applicant to achieve that and then enable them to go out and 
market the airplane, et cetera. 

They elected to go for a provisional when they determined they 
could not get a full type certificate, and we issued the provisional 
when they met those standards. But with every provisional, it is 
loaded. 

Mr. Oberstar. What did that mean operationally for the com- 
pany? Let me stop at that. What did it mean for Eclipse? 
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Mr. Hickey. It was an airplane that was virtually unflyable. It 
had so many limitations, it was essentially worthless. It had more 
value from a marketing standpoint than it had from an operational 
standpoi nt. 

Mr. Oberstar. In 2007, we had 491 general aviation aircraft fa- 
talities. FAA's work has brought that number down and so has 
AOPA's education program for pilots, and a great deal of work has 
been done to bring it from 684 fatalities on average a year down 
to 491. 

But with that in mind, you have to maintain your continued vigi- 
lance especially at the start of a process, in the certification, the 
type certification process. That is what we are looking for. 

Mr. Hickey. Sir, I couldn't agree with you more. I think as we 
demonstrated by issuing the certificate at that time and as the 
SCR validated, that airplane was type certificated properly and 
was in a condition for safe operation. 

I must add to what you said. You have said an absolutely correct 
statement. 

For every one of these airplanes, like an Eclipse or a new Cessna 
or any one of these new airplanes with the fancy avionics, for every 
one of those airplanes that enters the airspace system, an older, 
more antique airplane leaves the system. That has an incremental 
improvement in safety. We are very, very mindful of that when we 
do these certification programs. 

Mr. Oberstar. But here, we have the situation where the soft- 
ware problems led to engine freezing at full power and just nar- 
rowly avoiding an accident by very skilled pilots. 

Mr. Hickey. May I comment on that, sir? 

Mr. Oberstar. Yes, go ahead. 

Mr. Hickey. That was not a software failure in that particular 
case. That was the design, it turns out. 

Mr. Oberstar. Design of what? 

Mr. Hickey. That was an intended design that when one engine 
had some form of an anomaly, that the other engine would go to 
full thrust. That is my understanding of the Eclipse design. I be- 
lieve the following panel can elaborate on it. 

What they didn't realize, what they didn't envision at the time 
was that the scenario that actually occurred created more of a 
problem than it solved. 

But I don't believe that this was a software failure that we 
should have uncovered during certification. 

Mr. Oberstar. But it was a design. 

Mr. Hickey. It was a design intended to solve one problem. 

Mr. Oberstar. And that it was faulty is not a problem? That is 
what you are saying. 

Mr. Hickey. It was faulty in another scenario, that is correct, sir. 

Mr. Oberstar. Yes, that is what we are getting at. 

Mr. Hickey. Okay. 

Mr. Oberstar. Now Mr. Hayes earlier described that the pilot 
pushed the throttle forward, and there was metal that jammed, 
and that caused the problem. What we understand is that the soft- 
ware itself was faulty in its design. 

Mr. Hickey. Yes, sir. 
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Mr. Oberstar. And someone is supposed to pick that up ahead 
of time. 

Mr. Hickey. We didn't know what we didn't know. You are right, 
sir. 

Mr. Oberstar. Okay. Mr. Haueter, have you and NTSB reviewed 
this issue? 

Mr. Haueter. Yes, we have. We looked at the investigation. 

The throttle levers did not jam full forward. By going full for- 
ward, they exceeded the software's logic. They went past, say, the 
100 percent point. The software was designed that if you go outside 
a range, use the last valid piece of information which was full 
throttle. 

Mr. Oberstar. Has that situation occurred in any other flight of 
this aircraft? 

Mr. Haueter. Not that I am aware of. 

Mr. Oberstar. That it did occur was a signal that there was a 
big problem or was that software taken out of the aircraft and cor- 
rected in all other aircraft of that type? 

Mr. Haueter. Eclipse has since gone back and changed the soft- 
ware logic, yes, sir. 

Mr. Oberstar. Did they ground the aircraft until it was done? 

Mr. Haueter. No, they didn't ground the airplanes. 

They inspected the throttle quadrant assemblies. FAA came out 
with several ADs, and then there was a change to the software 
logic. 

Mr. Oberstar. There were some 200 aircraft produced at that 
poi nt. 

Mr. Haueter. Yes, a little over 200. Yes. 

Mr. Oberstar. A little over 200, is that correct, Mr. Hickey? 

Mr. Hickey. Yes, roughly around 200, sir. Yes, sir. 

Mr. Oberstar. Did FAA intercede at that point and say, "you 
have a problem here, you have to go back and fix it" and tell the 
owners of the aircraft "don't fly until you get your software re- 
placed?" 

Mr. Hickey. Well, what we did is, I believe, issue the airworthi- 
ness directive on the day the NTSB issued the recommendation. It 
called for the pilots to do a check on the throttle quadrant to make 
sure that it didn't exceed and engage that inadvertent software 
function. 

All the while, we are in the process, or Eclipse is in the process, 
of designing a fix for the software because, sir, the software itself 
did what it was intended to. 

But as we often see in certification, some designs are intended 
to do one thing, but they inadvertently cause problems in another 
thing, and that is what was the case here. 

Mr. Oberstar. Thank you, Mr. Chairman. 

Mr. Costello. Thank you. Chairman Oberstar. 

Let me clarify a point before I recognize my friend from North 
Carolina. 

Mr. Sabatini and Mr. Hickey both, you have referred and we 
heard from the Inspector General about the Special Certification 
Review Team, and you have indicated that immediately when these 
issues came to light the Acting Administrator put this review team 
together. 
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It is my understanding from talking to the I nspector General and 
the Acting Administrator that assembling the review team was ac- 
tually a recommendation of the Inspector General, that he rec- 
ommended that to the Acting Administrator. So I wanted to make 
that point. 

Secondly, I think at some point the IG may have suggested that, 
Mr. Wqjnar, you were on the review team. Is that correct? 

M r. Woj NAR. That is correct, M r. Chai rman. 

Mr. Costello. He questioned that maybe that could have been 
a conflict of interest with you reviewing the certification that you 
had basically been in charge of. But those are just items for the 
record that I think we should clarify. 

And, I think a very important point to make about the review 
team, and you correct me if I am wrong, but I am told that the re- 
view team did not look at any of the issues related to the approval 
of the production certificate. Is that correct? 

Mr. Sabatini. That is correct, sir. 

Mr. Costello. I n much of the IG's testimony today and his writ- 
ten testimony, he testifies about manufacturing problems that con- 
tinue today. So my question is have you gone back, the review 
team, and conduct^ a review of the production process of the EA- 
500? 

Mr. Sabatini. Well, let me begin by saying, Mr. Chairman, that 
we cooperated fully with the Inspector General, and until the 11th 
hour there wasn't a single word mentioned about issues around 
production certificates. So we focused on the issuance of the type 
certificate. 

But rest assured, Mr. Chairman, we are not narrowly focused. 
We are going to review this entire process. 

We are going to apply pretty much the same standard of over- 
sight that we do with the issuance of an Air Carrier Certificate: 
Unless you satisfy a particular phase, the first phase, you are not 
going to go beyond that first phase until you satisfy everything that 
needs to be done. 

That is under review, and I can assure you that it is going to be 
completed in a timely fashion. So the approach that we are going 
to take with type certification is going to mirror a great deal of 
what we do with the air carrier world. 

Mr. Costello. After the production certification went forward 
and was approved by the FAA, your own auditors, FAA auditors 
according to the I nspector General, of this aircraft, the suppliers of 
Eclipse found significant deficiencies occurring that should have 
been corrected. 

I mean your own people. After the production certificate was 
issued, your own inspectors found that there were deficiencies, 
things that should be, in fact, addressed. That took place. They 
were found between February and August of 2008. 

So I could go into a long list of them. You know what they are: 
Receiving or accepting nonconforming parts or tools, parts not 
properly stored or marked, failure to follow manual procedures, 
uncalibrated tools, revision to tooling and so on. I could go on and 
on. 
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The largest user of the EA-500, FAA inspectors found problems 
with Eclipse supplier-manufactured parts on 26 of the 28 aircraft 
operated by that company, the largest user. 

So my question is what have you done? What has the FAA done 
with the findings of those inspectors concerning the manufactured 
parts on 26 of those 28 planes? 

Mr. Sabatini. May I defer that question to Mr. Wojnar, please? 

Mr. Costello. Sure. 

Mr. Wojnar. Mr. Chairman, I think that shows that the certifi- 
cate management is working as it should in the FAA in the over- 
sight of Eclipse. I, personally, don't have the information on those 
details. As I said, I have not been involved in the oversight of 
Eclipse since production certification. 

But it is a normal thing. We do not issue a production certificate 
and walk away. Our oversight continues indefinitely. So, while we 
will have to provide the details, I think it illustrates that our sys- 
tem is working. 

Mr. Costello. Well, if it is a normal thing when 26 of the 28 
aircraft with the largest user, that your own people have identified 
problems with the manufactured parts, please tell me that you are 
doing something about this as we speak. 

Mr. Sabatini. Mr. Chairman, I don't have that information at my 
fingertips. We are addressing that, but I don't have the specifics, 
and I would like to get back to you on that, sir. 

Mr. Costello. I would say that if I were in your position, that 
would be a high priority for me to address those issues without 
delay. 

Mr. Sabatini. It is, sir. 

Mr. Costello. The Chair now recognizes Mr. FI ayes from North 
Carolina. 

Mr. FIayes. Thank you, Mr. Chairman. 

Mr. Wojnar, I missed something here. J ust comment, if you will, 
on the review panel. You were on there. Was there anything inap- 
propriate about that? 

Mr. Wojnar. Thank you for the opportunity, sir, to make the 
clarification. 

I was not involved in any way with the Eclipse type certification. 

I was formerly an executive in Aircraft Certification, but by the 
time of the type certification, I had left Aircraft Certification to join 
the Flight Standards Organization in the FAA, and I had been 
gone approximately a year from Aircraft Certification. 

So there, in fact, really was no conflict for me. 

Mr. Costello. If the gentleman would yield, just so I have a 
clear understanding here because maybe I am confused. Were you 
involved in the production certification? 

Mr. Woj NAR. Yes, sir. 

Mr. Costello. For the Eclipse EA-500? 

Mr. Wojnar. Yes, I was involved in the production certification 
which is a totally separate FAA decision. 

Mr. FIayes. You didn't give me a chance to say, of course, I will 
yield. 

If there were a time line or if there were no time line, the mo- 
ment of certification comes, is the FAA going to certify a plane that 
is unsafe? 



68 


Mr. Sabatini. Absolutely not. 

Mr. Hayes. Anybody else have a different answer to that? 

So I don't think the issue here is the time line. 

Next question, if you look at the process now, being where we are 
today, what are the major issues that you think this panel should 
deal with going forward? 

What are the major issues? Again, remember on the top of our 
letterhead here is safety. 

Mr. Haueter, you are the Safety Board guy. 

Mr. Haueter. I think one of the issues we see is and our certifi- 
cation study found that some of the assumptions you have in cer- 
tification do not pan out as time goes by. 

Mr. Hayes. Explain which assumptions. 

Mr. Haueter. Well, I think one of the assumptions here was to 
the throttle lever, that it would not go out of 100 percent range. 
Obviously, we had a pair of pilots who found, with normal force, 
it would. 

Mr. Hayes. So that means they pushed it right on into that 
panel, and it exceeded what the software said it would do. 

Mr. Haueter. That is correct. 

Mr. Hayes. How do you plan for that? 

Mr. Haueter. Well, it is something you have to consider, I think, 
during certification. I am surprised that wasn't found during the 
certification process by the test pilots. 

Mr. Hayes. Okay. Any others? 

Again, we have an issue and, Mr. Oberstar, you and I have 
talked about that. That is something. How do we prepare for the 
unexpected beyond any normal parameters? 

All right, Mr. Hickey? 

Mr. Hickey. Mr. Hayes, I would like to offer a couple things that 
I think this Committee is certainly looking for us to say. I have 
spent a lot of time since this has come up thinking about what 
would I do differently and what we should do differently because 
I completely agree with this Committee. These problems should 
never happen again, I do believe. 

Mr. Hayes. Now this event should never happen again. What is 
the event that should never happen again? Let's make sure we are 
on the same page. 

Mr. Hickey. The event is an airplane was certificated, type cer- 
tificated and production certificated, and there is a group of people 
who are very disappointed and disagree with those decisions. 

I consider that to be a failure. I take full responsibility for that 
as Director of Aircraft Certification. 

Mr. Hayes. Okay. I think that is important. I didn't understand 
that until you clarified. 

I hope the gentleman and the lady who are here understand be- 
cause that is part of our responsibility, whatever department we 
are in, to make sure. The relationship between management and 
the folks that are being managed is crucial. 

All right, go ahead. 

Mr. Hickey. Right. So, clearly, as I have been thinking about it. 
The fact that we place very high focus and attention on completion 
of a type certification program, whether it is an Eclipse or a Boeing 
or any other program, that can lead to problems. Especially when 
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certification is in many ways out of the control of the FAA. I think 
that is a lesson we learned and we are no longer doing that. 

When we build our Flight Plan and our AVS Performance Plan 
and my Aircraft Certification Plan, we create objectives that we 
clearly see are well within our control. So we don't place undue 
pressure on individuals to meet certain deadlines when it is really 
out of their control. I think that is a lesson learned that we have 
had since then. 

Mr. FI AYES. Well, I am a little confused by that. You can't set the 
timetable for the company, whoever it is, and they can't set the 
timetable for you. Your timetable is controlled in large measure by 
us, how many resources, how many people, but again there can 
only be so many people in one place at one time. 

I am not sure how we refine that down to a take-away from this 
discussion. 

Mr. FIickey. Let me try this. The take-away I think we have is 
how we conclude agreements between the FAA and companies on 
certification programs. We develop these project plans where we 
are committing to each other to do certain things and meet certain 
deadlines. But those deadlines are only conditional upon the other 
group meeting their deadline. 

So our performance is being measured on our ability to meet the 
deadlines we have committed to, and that deadline could very well 
be noncompliance. It doesn't necessarily mean we will find compli- 
ance or that the certificate will be issu^. I think that is a very dif- 
ferent thing from what occurred several years ago. 

Mr. FIayes. Maybe somebody who is not building airplanes, and 
somebody who is not inspecting airplanes but who has audit experi- 
ence sits down at the beginning of the process and says, folks, your 
time line is realistic or it is not realistic. 

So, again, we have to be careful so that undue burden is not put 
on either one because those tensions do exist. 

Mr. FIickey. I agree with you, sir. 

Mr. FIayes. The last thing, and I am trying to remember what 
it was. Again, looking forward to the ongoing discussion, I think 
this is the b^inning, not the end of the process. 

A single pilot, in certification, you can certify an airplane, day- 
light/night, VFR/IFR, known icing/no ice. So it needs to be clear to 
anybody that doesn't fully understand that a provisional certificate 
is not an anomaly. It is not escaping. 

That is just like you can put an incapable pilot— and we had that 
example earlier— in a capable airplane, and those don't mix. The 
fact that there is a provisional certificate, assuming the provisions 
of the provisional are met, that is not a big deal. 

As someone pointed out earlier, Dayj et has decided for mar- 
keting reasons, they will furnish 2 pilots for their Part 135 oper- 
ation. This is fine. But again, with complete review, this airplane 
can easily and safely be flown by one well-trained, one qualified, 
well-qualified and current pilot. So let's keep all that going. 

Mr. Chairman, thank you. 

Mr. Oberstar, I think, has a puzzled look. 

Mr. Sabatini. Mr. Chairman, if I may correct a statement I 
made? 

Mr. Costello. I thank the gentleman. 
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Were you wanting him to yield? 

Mr. Oberstar. Mr. Graves, has he been recognized? 

Mr. Costello. Mr. Graves is going to be recognized next. 

Mr. Sabatini, you wanted to clarify a point. 

Mr. Sabatini. Yes, thank you. 

Early on in the conversations working with the Inspector Gen- 
eral, in a Power Point presentation, I have learned that production 
certification issues were mentioned, but only recently did we have 
an opportunity begin to address those issues with them. 

Mr. Costello. The Chair now recognizes the gentleman from 
Missouri, Mr. Graves. 

Mr. Graves. Thank you, Mr. Chairman. 

Unfortunately, I have to go handle five bills on the floor here in 
a minute for the Committee, at least from our side. I haven't been 
up here for which I apologize, but if I could yield to Mr. Hayes I 
would love to continue to hear this and sit here and listen. 

Mr. Costello. Mr. Hayes. 

Mr. Hayes. I think I pretty well completed unless there is an 
issue that any of you or all of you collectively would like to bring 
to our attention and make sure we are not missing an important 
take-away here. 

Okay, the customer service thing, I think we never put the fin- 
ishing touches on the relationship there. Would any of you like to 
again clarify for all of us exactly what the approach is? 

I haven't really seen it as customer service since day one, but 
what do you think it is now going forward? 

Mr. Hickey. Mr. Hayes, I would like to address that from a type 
certification standpoint. 

Long before the CSI was implemented, I believe in 2002 or 2003, 
the type certification process has had what we call an appeal proc- 
ess. 

Engineering is very much not black and white but very gray. On 
dealing with compliance of any regulation, there are often very 
complicated and very technical debates over whether an airplane 
company is complying with a regulation. 

For the most part, it works fabulously. We write issue papers. 
We document the position that the FAA feels is appropriate for 
compliance to this regulation. The applicant writes the position 
that they would propose to do. 

For the most part, we come together. We have an agreement on 
how compliance can be shown. 

On occasion, there are issues where there are differences of opin- 
ion. The company feels that they would like to show compliance in 
this way. The FAA has a different nuance. The parties are a little 
bit concerned about this or a little bit concerned about that, and 
so they stress that. 

Keep in mind the r^ulation, quite frankly, is very performance- 
based. It gives flexibility to meet the requirement. 

For many years, what we have is, when the debate has ended, 
we have a process that has been well documented and it is re- 
flected in the agreements we make. Disagreements get elevated to 
the next level. 

This is not a case of a customer getting some favorable treat- 
ment. This is a case of a different set of eyes, a more senior set 
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of eyes reviewing both sides, looking at the issue to see if we can 
come to resolution. 

If that fails, the resolution goes to another higher level, and it 
goes to a senior level until we reach resolution. That is a very com- 
mon thing, and it happens, and it should have happened in this 
process with respect to the software certification. 

Unfortunately and regrettably, I must say it did not. There was 
not an issue paper written. I think there were decisions made with- 
out documentation, and it is not surprising that there are a num- 
ber of the people who testified who felt that their position was in- 
adequately conveyed and considered. 

I seriously regret that, and I take full responsibility for that. 

So one of the take-aways I have from this process is that I am 
going to strictly enforce this process of getting issue papers such 
that, again in the event of this type of issue, the people like Mr. 
Wallace, who had a very strong opinion, can have a vehicle for pre- 
senting that opinion where we have a very documented way of 
disposition! ng it. 

Mr. Hayes. If he loses, how are you going to deal with it? And 
if you lose, how are you going to deal with it? 

Mr. Hickey. Unfortunately, in our business, not everyone is in 
agreement with every issue. 

Mr. Hayes. Mr. Graves, thank you. I yield back. 

Mr. Graves. I don't know if it has already been asked, but how 
much time does it usually take to certify an aircraft? What is the 
average time? 

It took five years for Eclipse. Isn't that a little long or is it not 
a little long? Am I mistaken there? 

Mr. Hickey. Yes, sir, Mr. Graves, it is a little long. 

The regulations create a nominal period of time, and it is largely 
based on the need for setting the certification basis. A company 
wants to know precisely what are the regulations they have to de- 
sign their airplane to. 

If you don't set that, regulations come and go and the airplane, 
when it is just about done, may have to comply with a new regula- 
tion, et cetera. 

The regulations call for, for a transport airplane like a Boeing, 
five years as the nominal period. 

For all other products, which would include the Eclipse 500, 
three years is the standard period. It turned out they needed over 
five years to do it. We granted an extension to them. 

Mr. Graves. Thank you, Mr. Chairman. 

Mr. Costello. I wonder if you would yield to the Chair, Mr. 
Graves. 

Mr. Graves. I will yield. I would be happy to, Mr. Chairman. 

Mr. Costello.] ust to clarify a point, when we are talking about 
five years and we haven't gotten into this issue with this panel, but 
the ODAR was issued in 2002, about four years before the Design 
Certification was issued. 

So when we are talking about five years to get a time line and 
an understanding of this, the fact is that Eclipse was not going full- 
force through the process. There were issues with an engine where 
they had to change course. There were issues with investors and 
other things. 



72 


It wasn't that they were pressing the FAA or they were moving 
forward the entire time. They had some issues that they had to 
deal with externally as well. Is that an accurate statement, Mr. 
Hickey or Mr. Sabatini? 

Mr. Hickey. I think it is accurate, Mr. Chairman. 

Mr. Costello. Thank you. 

The Chair now recognizes Chairman Oberstar. 

Mr. Oberstar. Mr. Hickey, I want to compliment you on accept- 
ing responsibility, and I accept your version of what FAA is going 
to do rather than Mr. Hayes who is trying to, I think, reword what 
you are saying. 

I think you are on the right course. You have found some short- 
comings in this process, very serious shortcomings, and both you 
and Mr. Sabatini are committed to correcting those. That is the 
spirit of leadership that I expect from FAA, and we will watch very 
closely. 

To put the issue that you described earlier, a procedure in which 
those who are deeply involved in the certification process raise 
questions, raise issues and have concerns can be sure that they are 
fully responded to. It is not a question of he loses or you lose. The 
question is does the owner-pilot lose? 

Your job, the FAA's, is to make sure that doesn't happen. 

Mr. Hickey. I agree, sir. 

Mr. Oberstar. So it is not who loses and who wins. The real 
issue is are there concerns raised by professionals— skilled, tal- 
ented, seasoned professionals within the agency, fully respected, 
fully responded to, not deadlines that are arbitrarily or externally 
or even internally established. 

In this certification process, you are right. It takes at least five 
years for transport aircraft to reach certification, at least, longer if 
you go back into the engineering and design. 

It was at least five years before the Cirrus all-composite aircraft 
was certified, and th^ complained about this, that and the other 
and a whole host of things. But those strain gauges were essential 
to test that wing structure. Should it be two wings joined in the 
middle? Should it be a single wing? 

They went through a great deal of testing to make sure that the 
ultimate design, type certificated and production certificated by the 
FAA, was the right design. 

At 41,000 feet in the air, I have said it so many times, there is 
no curb to pull over and look under the hood and see what has 
gone wrong. 

Mr. Hickey. I know. 

Mr. Oberstar. You have to get it right on the ground, and that 
brings me to the question of the one-pilot versus two-pilot. 

The information we have is that FAA test pilots were opposed to 
approval of the aircraft for single-pilot operation, yet they were 
overruled. I want you, Mr. Sabatini or you, Mr. Hickey to respond 
to that. 

Mr. Sabatini. Well, let me begin with how the process works, sir, 
if I may. 

Once an airplane has been demonstrated to meet type certificate 
and by design is approved for single-pilot operations because engi- 
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neers have done the study to determine that the switches and the 
controllability of the aircraft is suited for that. 

Once that is done, it now needs to be determined how, operation- 
ally, we will introduce this aircraft. That is the job of the Flight 
Standardization Board. They make determinations as to what kind 
of training is required, what kind of type rating should be issued 
and a host of other responsibilities. 

As Mr. Hickey mentioned and I will reiterate, this process that 
we have observed here lacked much in terms of project manage- 
ment and communication. 

What happened with the beginning of the Flight Standardization 
Board is Eclipse went directly to the Flight Standardization Board. 
That will not happen again. In doing that. Eclipse presented to the 
Flight Standardization Board an aircraft that had not been dem- 
onstrated to conform to type design, which is unusual. 

We ended up with three phases of the Flight Standardization 
Board. Phase one was terminated because the airplane could not 
demonstrate, based on the kind of training that our Flight Stand- 
ardization people were receiving, to determine that they could safe- 
ly operate this aircraft as a single pilot. 

They deconvened, and at that point in time is when the single 
pilot issue arose. They met again, and other issues arose. It wasn't 
until the third time that they got together that the Flight Stand- 
ardization Board determined that the work load for a single pilot 
was now acceptable, that the training that was being delivered was 
appropriate for that kind of operation. 

I know that pilots have been interviewed who have said that it 
is a high work load. Well, these are the very same pilots who have 
been tested and have demonstrated they are capable and com- 
petent of operating these airplanes as a single pilot. 

Mr. Oberstar. That latter point, the testing level, is extremely 
important. 

Mr. Sabatini. Absolutely. 

Mr. Oberstar. If you are going to be operating this very high- 
tech aircraft, you really have to know. You have to go through a 
much more rigorous regime. 

Are you saying then that within the FAA this issue of one versus 
two pilots was vigorously debated and resolved in the favor of a 
single pilot? 

Mr. Sabatini. Well, the Flight Standardization Board made that 
determination. The Board alone made the determination. 

Mr. Oberstar. Certainly, from the standpoint of the manufac- 
turer, they would much rather sell an aircraft whose operational 
cost was lower because you only have one pilot, not two. 

Mr. Sabatini. That is true. But operationally, the Flight Stand- 
ardization Board made recommendations for two types of rating for 
that airplane. One is for a single pilot and the appropriate training. 
Testing and qualification is required. 

The other is for a multi-crew. It has been mentioned that Dayj et 
operates as a crew of two. 

I recall long before Dayj et even existed, Mr. lacobucci came in 
and visited with us and told us about his business plan. I spoke 
to him just the other day to verify my recollection. He never in- 
tended to ever operate as a single pilot. 
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It has always been his business model for customer reasons to 
operate with a crew of two even though his pilots are being issued 
single-pilot certificates. Their business plan requires them to oper- 
ate as a multi-crew. 

Mr. Oberstar. What is the basis for distinction between single- 
pilot and multi-pilot? 

I will rephrase my question. What are the FAA-established dis- 
tinctions between those two ratings? 

Mr. Sabatini. Well, of course, the training is essential, appro- 
priate to the aircraft. 

Mr. Oberstar. But it is for the same aircraft. 

Mr. Sabatini. For the same aircraft. Then there must be, for sin- 
gle-pilot, you must have a headset and a couple of other things that 
escape me right now that are mentioned in the Airplane Flight 
Manual and must be available for that kind of operation so that 
it eases the burden on the pilot. 

But let me just say, airplanes are built with many systems. I 
have started in this business as an FAA Inspector. I have adminis- 
tered many flight checks. 

I am also a pilot, and I have been given many flight checks. I 
have never had the luxury of operating an airplane during those 
conditions with everything working. You always test or are tested 
when most of the systems fail to determine your ability to operate 
that airplane safely with whatever condition exists at that point in 
time. 

The FAA requirements are very clear in the practical test stand- 
ards, whether it is for an operating rule for Part 135 or any other 
operation. The pilot must demonstrate that he is competent and 
qualified to operate that aircraft alone with systems inoperative. 

Mr. Oberstar. Does that also require recurrent training? 

Mr. Sabatini. Absolutely, sir, particularly under 135. 

Mr. Oberstar. Well, I look forward to the commitment you have 
made to reprinting the Customer Service I nitiative, unless we abol- 
ish it altogether in a future legislation, and to the interim correc- 
tions from lessons learned that Mr. Flickey has described and I 
think with quite earnestness. 

Mr. Chairman, I think it would be appropriate either to have an 
in camera review or a Committee review at a later date to assess 
the follow-up compliance with our own standards. 

Mr. Costello. I think that is an excellent suggestion. 

I had mentioned earlier in the hearing that we expect in the not 
too distant future that we will have the FAA, Eclipse and others, 
other stakeholders here involved come back, sit down and discuss 
what progress has been made relative to future action on the part 
of the FAA and pending issues with the aircraft. 

I only have one remaining question, and it is for Mr. Flaueter. 

You heard Chairman Oberstar's question on certifying the air- 
craft for a single pilot. Given the complexities of the aircraft and 
the fact that the FAA test pilots recommended or wanted it not to 
be certified as single-pilot but two-pilot, do you agree with the 
FAA's decision to certify it as a single-pilot? 

Mr. FIaueter. I don't think I have enough information. Certainly 
the Cessna Citation was certified for single-pilot operation. It is not 
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that greatly different than the Eclipse necessarily. I don't know all 
the facts here. 

Mr. Costello. All right, good. Thank you. 

Mr. Hayes, any closing comment? 

If not, let me thank this panel, and let me restate what Chair- 
man Oberstar said, Mr. Hickey. We appreciate the fact oftentimes 
people come before the Subcommittee and Full Committee and we 
are used to hearing people deny and push responsibility and blame 
on other people. 

We are pleased to hear you take responsibility for some of the 
things that you think the FAA needs to correct in the future re- 
garding when there are people who are objecting internally. So we 
appreciate your honesty. 

I also want to mention, as I mentioned at the earlier panel, we 
had, as you know, current FAA employees who had the courage to 
come here and to speak with us and testify about their opinions. 
There is one former FAA employee and the current employees who 
testified. 

We will be following very closely to make sure that there is no 
retribution towards those employees. I have asked them specifically 
to contact me personally if, in fact, they feel that there is retribu- 
tion, if there is a job reassignment, if there is any retribution what- 
soever. 

So I believe and I hope that you believe that it is healthy for peo- 
ple to come forward and to state their opinions regardless if you 
agree with them or not. I think it strengthens the operation, in this 
case, at the FAA. I hope you will respect the fact, as we do, that 
they had the courage to come forward and discuss their differences 
of opinions with you and to state their opinions on the record. 

With that, we again thank you for your testimony, and this panel 
is dismissed. We would ask the next panel to come forward, please. 

Members of this next panel are coming forward to be seated. I 
will introduce them: Ms. Peg Billson, President and General Man- 
ager, Manufacturing Division, Eclipse Aviation Corporation, accom- 
panied by Mr. Roel Pieper, the Chief Executive Officer, Eclipse 
Aviation Corporation; and Mr. Clyde Kizer, retired aerospace exec- 
utive. 

Lady and gentleman, if you will come forward, I would ask you 
to remain standing and I will administer the oath, if you will. 

We have all three. Is Roel Pieper here? 

Ms. Billson. He had to leave. 

Mr. Costello. He had to leave. Okay. 

If you will raise your right hand please, do you solemnly swear 
that the testimony you give before this Committee in the matters 
now under consideration will be the truth, the whole truth and 
nothing but the truth, so help you, God? 

For the record, please show that both witnesses answered in the 
affirmative. 

First, we thank you for your indulgence here in listening to all 
of the testimony. I am quite certain that you wanted to be here, 
but we had hop^ to get to this panel sooner. 

With that, I will recognize Ms. Billson for your testimony. 
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TESTIMONY OF PEG BILLSON, PRESIDENT AND GENERAL 

MANAGER, MANUFACTURING DIVISION, ECLIPSE AVIATION 

CORPORATION; CLYDE KIZER, RETIRED AEROSPACE EXECU- 
TIVE 

Ms. Billson. Thank you, Mr. Chairman and the Committee. 

I am Peg Billson. I am currently the President and General Man- 
ager of Eclipse Aviation's Manufacturing Division. Over the pre- 
vious three years, I was the Chief Operating Officer of Eclipse 
Aviation, responsible for the type certification and production cer- 
tificate of the Eclipse 500 jet. 

My background is that I have a Bachelor's and Master's in Aero- 
space Engineering. I am a private pilot, and I have had 25 years 
in the industry at McDonnell Douglas, Honeywell and now at 
Eclipse, designing, building and certifying airplanes. 

In fact, I am also an instrument-rated pilot, and I have about 80 
hours in the Eclipse 500. 

Mr. Roel Pieper, as we stated, was here just until about five min- 
utes ago, and he is our current Chairman and CEO of Eclipse. 

I would like to address some of the things that I have heard here 
today and read, so I can clear up some misconceptions or our per- 
spective of how we believe the process went. 

The first is with the Inspector General's report. I think it is im- 
portant to highlight that Eclipse Aviation has not been interviewed 
by the Inspector General. So as we look forward to that oppor- 
tunity, we also are not knowledgeable of what the March, 2007 
complaint refers to. We have never been shown that. We don't 
know the basis of that. 

We look forward over the coming months to be able to participate 
in that process, so we can clear up what I have heard today as a 
lot of misstatements, misconceptions, misunderstandings in the 
data that I have heard today. 

Specifically, it is not accurate to state that EASA, the European 
certifying agency, has denied certification of this airplane. In fact, 
we are in the middle of the process, and we expect it to be com- 
pleted in the next few weeks. 

When that is completed, it will verify that this airplane has been 
demonstrated to comply with not only the FAA's requirements but 
all of the European Union's requirements as well, demonstrating 
this airplane is safe to fly in not only the United States but the 
European Union nations. 

But the next point I would like to make is that Eclipse cooper- 
ated fully with all levels of the FAA management through our cer- 
tification processes and through the approval of our pilot training 
program. That would be the type certification process, the produc- 
tion certification process and the Flight Standards Board. 

Yes, we had challenges. We have been at this for a long time. Oc- 
casionally, we did encounter lack of understandings, disagreements 
on what the process was going forward. So, when we would run 
into those situations, we would work up the layers of levels within 
the FAA until we could agree or reach agreement to both of us that 
this was the right process to go forward. 

I think the most significant or prominent area where this was 
highlighted was during the production certificate. We believe it is 
very rare that new production certificates are granted, and so the 
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experience level within the FAA on how to accomplish this process 
is limited. 

And so, throughout the process, there are numerous instances 
where there was different direction, misdirection, change in direc- 
tion on what was required to achieve our production certificate. It 
was only after my inability to get that clarity with the head of the 
Fort Worth certification office at that time did we elevate our con- 
cerns to the Washington headquarters and asked for assistance. 

After they evaluated the situation, they decided to convene an 
independent board of experienced people to work with the Fort 
Worth office and Eclipse Aviation and lead us through the process 
of certifying this airplane or helping us attain our production cer- 
tificate. I n fact, it did take eight months after we received our type 
certificate to earn our production certificate. 

I certainly respect and appreciate the perspectives of the FAA in- 
spectors that are here today and had the courage to come forward. 
It was a very confusing, frustrating time where everybody played 
different roles at different periods of time. 

And so, I think that frustration level that I even experienced per- 
sonally supports the decision to let's bring in an independent group 
of experienced people to help lead all of us through this process, 
which is what they did. 

Let me also talk then briefly about the Flight Standards Board 
and the confusion around the Flight Standards Board who ulti- 
mately made the single-pilot evaluation determination and ap- 
proved our pilot training program. 

I gave them an immature airplane twice. I won't do that again. 

I am experienced several times in certifying airplanes. This was 
the first time I went through a Flight Standards Board process, 
and it is perfectly logical that I needed to give them a type design 
compliant airplane, so they could cleanly and clearly effect their 
evaluation. 

We had some false starts. It was an inefficient process. 

So I would really characterize today's hearing as a lot of people 
are trying to resurrect years of work by a lot of hard people. We 
are not all remembering it exactly correct. 

But the results were effective. We have a compliant airplane, we 
have a safe airplane, and I am proud of my role on the Eclipse 500 
program. 

Mr. Costello. Thank you. 

Mr. Kizer. 

Mr. Kizer. Chairman Costello and Members of the Sub- 
committee, thank you for the opportunity to testify today. 

My name is Clyde Richard Kizer, and my statements reflect ob- 
servations, facts and opinions garnered over a 44-year technical ca- 
reer in the aerospace industry. 

I realize that the focus of these hearings is on the certification 
of the Eclipse EA-500. My statements today relate for the requisite 
requirement for the concept of alternative method of compliance to 
assume a vibrant environment of innovative engineering and tech- 
nology development for the aerospace industry. 

Absent the application of technical vision and the exploration of 
new materials, concepts and processes, our Nation will rapidly fall 
behind in this globally critical industry. My comments relate spe- 
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cifically to the need for a methodology that allows consideration of 
alternate means of compliance within the regulatory process. 

My experience and training relate predominantly to the arena of 
airline aircraft continued airworthiness, and I will focus my com- 
ments to that position, but the concepts that I discuss have value 
for all venues of technical development albeit with differing prac- 
tical priorities, frequencies of application and regulatory oversight 
requirements. 

Equally important to the success of the aerospace industry as the 
alternate method of compliance is the development of and adher- 
ence to minimum standards for regulatory compliance to ensure 
the safety of the aircraft, the public and the national airspace sys- 
tem. 

The remarkable safety record of the U.S. air transport industry 
is the result of the robust process of communications, coordination 
and exchange of technical information that exists between the oper- 
ators, the manufacturers and the regulatory agency. No single enti- 
ty within these constituents can assure the desired level of safety 
independently. 

The success of the endeavor depends on effective collaboration. 
The free exchange of technical information provides a venue for in- 
novative alternative technical resolution of potential problems from 
differing perspectives of responsibility. 

Over time, the process allows a variety of methods for technical 
problem resolution from which it is possible to develop a best prac- 
tices resolution for standardization, effectiveness and efficiency. 
Absent such approach, standardization might potentially be 
achieved by forced adherence to the least effective methodology. 

Over decades of commercial air travel, many new technologies 
have been developed to improve the safety and efficiency for the 
traveling public. Emerging technologies demand a conservative ap- 
proach for application, operation and regulatory control to assure 
that the safety of the system is not compromised. That conservative 
approach results in the establishment of minimum standards of 
performance that protect the industry while allowing flexibility in 
the development of the new technologies. 

Unfortunately, the term, minimum standards, occasionally con- 
notes an atmosphere of laxity when in fact it is just the opposite- 
restrictive set of requirements that must be met in a very conserv- 
ative approach to develop new technologies and/or methods for res- 
olution of technical problems. 

It is a general truth that no two aircraft leave the manufactur- 
er's production line in exactly the same configuration. Additionally, 
once an aircraft enters service, no two aircraft of similar type are 
in exactly the same configuration within a given airline or between 
the airline fleets. 

The responsibility of the airlines is to maintain their aircraft so 
that they conform to type design and type certification require- 
ments that were established to assure airworthiness for the certifi- 
cation and production of commercial aircraft. This requirement for 
conformance is termed continued airworthiness. 

The continued airworthiness process includes incorporation of 
methods to address any action that modifies the original type cer- 
tification requirements such as airworthiness directives, supple- 
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mental type certificates and so on. The industry dedicates consider- 
able technical resources for maintenance and engineering activities 
to meet this responsibility. 

When technical problems are defined and addressed by manufac- 
turer service bulletins or regulatory requirements, the specified 
means of corrective action frequently requires variations due to 
configuration differences, material applications or other consider- 
ations. 

When corrective actions are mandated by the FAA, generally by 
issuance of an airworthiness directive, such actions frequently in- 
clude a means to employ differing methods, materials and/or timing 
to accomplish the mandatory action. These alternatives are allowed 
only after approval by the FAA Aircraft Certification Office des- 
ignated in the AD. FAA approval for alternative methods must be 
obtained prior to the required date for completion of the action de- 
fined in the AD. 

This approach is described as the Alternative Method of Compli- 
ance or AMOC process. The AMOC process allows accommodation 
for alternatives that might not have been known or considered at 
the time the AD was written. The primary requisite for this process 
rests with determination that the alternative provides an accept- 
able level of safety that is equivalent to that required by the AD. 

As a comparison of the viability of the alternative methodology, 
a similar process is allowed during certification by longstanding 
regulation 14 CR 21.21. Now we won't go on that because that is 
the certification process, but it is a similar process and it is Equiv- 
alent Level of Safety or ELOS. 

It is obvious that the AMOC and the Equivalent Level of Safety 
or ELOS processes allow consideration for differing technical exper- 
tise, varying operational experiences, new technologies and innova- 
tive methodologies while protecting the safety and efficacy of the 
air transport system and not compromising the responsibility or 
prerogatives of the regulatory authority. 

The intent of the AMOC/ELOS process is to maintain or improve 
the safety of the aircraft and the industry while allowing the em- 
ployment of technical innovation and new technologies to resolve 
technical problems. 

Over many years, the concept of alternative methods of compli- 
ance has proven to be a safe and effective approach for regulatory 
compliance. The AMOC/ELOS process has provided creative alter- 
natives that are crucial to the air transport industry, and in my ex- 
perience it is that these processes are equally essential for general 
aviation. 

Thank you very much. 

Mr. Costello. I thank you, Mr. Kizer. 

The Chair would recognize the Ranking Member for any ques- 
tions that you may have. I only have a few and then a statement 
to make, but I would recognize Mr. Petri. 

Mr. Petri. Well, I want to thank both of you for your testimony 
and for so patiently waiting through the day until we reach this 
poi nt. 

This was a five, almost six-year process for Eclipse, and it was 
a new learning experience, I think, for that organization. This is 
the first certification that you went through, is this correct? 



80 


Ms. Billson. This is the first certification that the Edipse Avia- 
tion Company went through, it is the fifth certification that i have 
personaiiy been through. 

Mr. Petri. Mr. Kizer, you have over 40 years of experience in 
this whoie process, and you obviousiy know a iot more about it 
than certainiy i ever wiii. 

My concern is we are having to figure out here, and this is a kind 
of smaii exampie of it, how to have some standards, make sure that 
we don't get peopie who are irresponsibie into the system as sup- 
pi iers or assembiers or whatever and, at the same time, have a 
very dynamic system that aiiows new innovation into it. 

i n that connection, a feiiow i had the opportunity to iisten to give 
iectures about this named Burt Rutan who is way out. 

Mr. Kizer. He is outside the box. 

Mr. Petri. The greatest aviation designer probabiy, one of them 
in worid history, if not. 

He was pieading at the meeting i was at when he was entering 
the competition for this new space vehicie, that it be dassified not 
as an airpiane but as a spaceship because then it wouidn't have to 
be certified. They don't certify spaceships. 

His reason wasn't he wanted to escape any reguiation or any- 
thing. it was that he feit the psychoiogy of defending a particuiar 
design was exactiy opposite of what he was trying to buiid in his 
organization, which was that every day he wanted peopie to as- 
sume that the worst couid happen and figure out a better and safer 
way of doing it. 

So they are constantiy making what they hope are improve- 
ments, refinements, it is a very dynamic process. 

He feit once they were trying to define and defend a particuiar 
design, it changes your mind. You are trying to defend why it is 
safe rather than question how to make it safer. 

That wouid end up stifling innovation and be counterproductive 
to true safety. We wouid end up with some safety innovations that 
wouid not be made because of that. 

i don't know if that is worth commenting or not. But what we 
want, don't we, is to have a coiiaborative where peopie are con- 
spiring to be as innovative and have a safe product at the end of 
the day rather than just piaying games on each other and not com- 
municating and pretending to meet standards. How do we do that? 

Does that make any sense at aii to you? 

Mr. Kizer. i wouid just iiketo make a generai statement in that 
regard. 

The peopie in this industry who bear the responsibiiity for 
human iives, whether it is in the miiitary side or the commerdai 
side, i have never met anyone who did not bear that responsibiiity 
with great commitment. No one that has the responsibiiity for safe- 
ty or for personai iives wouid make decisions that wouid put those 
things in jeopardy. 

So, consequentiy, when we are expioring new technoiogies, we 
know there is great promise, but we aiso know that iacking a his- 
tory with those new technoiogies we have to take a very conserv- 
ative approach to the deveiopment of the technoiogies. 

That sometimes means that we use things in different appiica- 
tions other than aircraft and we garner some experience with it. 
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but it frequently means that we use the technology in lesser modes 
instead of the primary modes until we develop enough history that 
we can explore the full potential of the technology. 

And, we have to demonstrate ahead of time minimum safety 
standards, sometimes in terms of inspection periods and things like 
that, until we garner the experience or limitations on the applica- 
tion until we have the experience to take those technologies and 
fully explore their potential. 

Everyone, be it an engineer or a pilot or a mechanic or a produc- 
tion guy on the line, all know that when they are working with 
new technology they have to do so in a step by step process in 
order to fully exploit that new technology. 

Mr. Costello. The Chair thanks you, Mr. Petri and now recog- 
nizes my friend from North Carolina, Mr. Hayes. 

Mr. Hayes. Thank you, Mr. Chairman, and thank you all for 
being here. 

You have been here a long time. You have heard a lot of things. 
Some are observations. Some are accusations. Some were opinions. 
Some were facts. 

Kind of sum up again, as I asked the last panel, where we are 
with this process and what it means to you as a manufacturer in 
how you would like to see the process proceed, again, because the 
confidence that the world has in our aviation and in our regulatory 
agencies, among other things, must come out of this process as 
being unscathed and still the gold standard. 

So just let me offer you time to generalize on what do you think 
we need to do to make sure that this process has been most effec- 
tive today. 

Ms. Billson. Sir, today, a lot of what I have heard is confusion 
between a type certification, a production certificate, putting a cer- 
tificate of airworthiness on an airplane and getting approval of a 
pilot training program. So I think that is a lot of the confusion that 
has come out today. 

One of the other things that has been highlighted is I will offer 
up two thoughts. One, the FAA and industry have to work together 
to drive closure on certifying product. We have to work together. 

The FAA, right now, appears to have a very effective process 
where it is the obligation of the manufacturer to come forward and 
say, this is how long I think it is going to take, given these sort 
of assumptions. The FAA comes forward and says, given everything 
I have to do, this is what I can do to support you on the time line 
you want. And you work together to negotiate a time line that you 
are trying to achieve. 

There is always an understanding if something changes, if there 
is a risk, if a test doesn't pass the way you thought it was going 
to do, that is going to affect your time line and you are going to 
adjust it appropriately. 

I think what needs to be highlighted is that there are different 
sets of experiences. So there are some people that are experts in 
Part 25 Certification, some in Part 23, some that know how to do 
production certificates. 

If I would offer up anything, it is maybe the FAA wants to ap- 
proach these types of projects based on pools of experienced people, 
not just assigning them by region. 
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Mr. Hayes. Mr. Kizer? 

Mr. Kizer. Well, we are at a state where in many cases the 
knowledge and the experience and the training of the people that 
are required to regulate the industry is frequently behind the tech- 
nology. 

That is not a condemnation of the FAA. That is a reality, that 
the technology moves so fast, that unless you are continually being 
reeducated in universities and self-training, it can get ahead of 
you. 

It is vitally essential that we have a methodology, I think, that 
draws upon the best expertise in the industry, wherever it comes 
from, to help develop the technology. 

If the FAA needs help in the field from a higher level or from 
the engineering group that exceeds their capability, they ought to 
have that authority to seek that assistance. And, if it takes bring- 
ing people in from the industry or from the universities to educate 
the process, we need to have that as well because we quickly, both 
in the area of composite materials and in digital avionics and elec- 
tronics, are moving ahead faster than we can stay educated. 

Mr. Hayes. A quick question, I don't think we touched on it 
today. In a certified repair shop, you have an employee who is des- 
ignated as the Chief Inspector. In the manufacturing and produc- 
tion process, do you have a similar employee? 

Mr. Kizer. The big aircraft manufacturers do. I don't know about 
Part 23. 

Mr. Hayes. Do you know, Ms. Billson? 

Ms. Billson. I don't have somebody per se that is designated as 
the Chief I nspector in my production line. I do have the people that 
are the Chief DAR and then leaders throughout my quality organi- 
zation. 

Mr. Hayes. For a minute, I think it would be helpful. There have 
been some specific actions cited: the throttle issue, the dual versus 
single pilot issue, the static port issue. Those are the three that 
come to mind. 

As a follow-on for this, Mr. Chairman, if you would just address 
a letter to the Chairman and a copy to me, what the issue was 
from your perspective from the b^inning, how it was handled at 
the time and how it has been ultimately satisfied. Again, I think 
it is good for the product and for the process. 

With that, Mr. Chairman, that pretty well wraps me up unless 
you all would like to add an^hing else. 

Ms. Billson. We would be more than pleased to do that, sir. 

Mr. Costello. I would agree, Mr. Hayes. As I said, we are going 
to revisit as a result of our discussion to talk about what progress 
has been made. 

You made the statement, Ms. Billson, that the IG has not spoken 
with you. 

This whole hearing and the investigation conducted by the In- 
spector General was about the FAA and the process that the FAA 
is using in the certification process. They obviously received com- 
plaints from employees and others internally within the FAA, and 
they responded and conducted an investigation. 

This hearing is not about Eclipse. It is about the FAA and the 
process that they use. You just happen to be the product that was 
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in the shop at the time, and there are serious allegations that were 
made here at the witness table. You heard them yourself. 

It is our goal to provide aggressive oversight to make certain that 
the FAA, in fact, is doing their job. We have seen in other areas 
of the economy what the lack of oversight can result. 

It is our hope that, as Mr. Sabatini said today in his testimony, 
that they are going to go back, reassess some of the things that 
they hao done, establish a procedure for certification in the future, 
for a new type of aircraft that is coming online like the Very Light 
J et, to develop procedures to get out in front as opposed to react- 
ing. 

So I appreciate your testimony here today. We have some other 
issues that we will be addressing in writing, and I would ask if you 
would comply with Congressman Hayes' request to address some of 
these issues in writing to us. We would appreciate that. 

I would give you and Mr. Kizer an opportunity, if you would like, 
for any closing remarks. I would be happy to offer you that oppor- 
tunity. 

Ms. Billson. Well, I think I reinforce and support your objective, 
but I think the purpose of the Inspector General's investigation is 
to get to the facts. And so. Eclipse offers to talk with the IG to help 
clear some of the misstatements and the mis-facts that are in the 
current testimony as I have heard it today. So I think that is the 
most important thing to highlight, 

I think the other point we would like to emphasize is that we are 
very proud of the certification of the Eclipse 500 program and the 
hard work of the FAA employees. I mean they just did a fantastic 
job on this program. They worked hard, and I think in the light 
of day they are proud of the product that they certified and the air- 
plane that is out there right now. 

Of the data we have looked at, we have the best safety record 
of a general aviation that has entered service in the last two dec- 
ades. That doesn't mean we ever acquiesce our accountability to 
continue to drive and improve and react rapidly when issues occur. 

It is a complex process executed by a lot of humans. You are 
never going to get it right. So you have the obligation to continue 
to follow up, analyze, work with your customers, understand how 
your airplane is performing and improve it. That is what we are 
committed we will continue to do. 

Thank you, sir. 

Mr. Costello. We thank you. 

Mr. Kizer. 

Mr. Kizer. No further comments, sir. 

Mr. Oberstar. Very good. 

Mr. Petri, unless you have further questions or comments, we 
thank both of you, Ms. Billson and Mr. Kizer, for testifying, and 
this concludes the hearing. 

The Subcommittee will stand adjourned. 

[Whereupon, at 3:33 p.m., the Subcommittee was adjourned.] 
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THE HONORABLE RUSS CARNAHAN (MO-3) 

HOUSE TRANSPORTATION AND INFRASTRCUTURE COMMITTEE 
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Hearing on 

FAA Aircraft Certification: Alleged Regulatory Lapses in the Certification and 
Manufacture of the Eclipse EA-500 
Wednesday, September 17, 2008 
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Chairman Costello and Ranking Member Petri, thank you for holding this hearing on the 
investigation of the rushed approval of both the type and production certifications of the 
Eclipse EA-500, despite safety concerns with the design and manufacturing of the aircraft 
raised by numerous FAA certification engineers and aviation safety inspectors. 

In 1996 Congress removed the "promotion of aviation" FAA mandate, making it clear 
that the FAA's explicit obligation was to the safety of the traveling pubic. Congress 
realized that there could be conflicting interest keeping the FAA from meeting its chief 
purpose, safety. Yet here we are twelve years later dealing with a lack of regard in 
safety, due to the FAA continuous consideration of the aviation industry as their 
customers rather than the traveling public. 

I am appalled by the allegations that the engineers and safety inspectors in AIR found 
deficiencies in the design, and yet the EA-500 became certified and the warning signs 
ignored. What is more disturbing is why these allegations of deficiencies were 
overlooked. It seems that the Eclipse founder, Vem Rayburn, had a strong influential 
presence with FAA senior managers. The same senior managers who allegedly relieved 
those worried with design deficiencies of their former duties with the Eclipse program, 
and replacing them with those more amenable to management’s desire to certify the 
aircraft by its self-imposed deadline. 

I hope that we can understand why FAA certified a plane that had eighty-one Service 
Difficulty Reports filed over a ten month period, and learn from the experience without 
the loss of future lives. I expect that a greater caution will be given to the concerns of 
engineers and safety inspectors in the future. 

I would like to thank the witnesses for joining us today, and I look forward to your 
testimony. 


H l) H tl II 
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Statement of 

The Honorable Jerry F. Costello 

FAA AIRCRAFT CERTIFICATION: ALLEGED REGULATORY LAPSES IN THE 
CERTIFICATION AND MANUFACTURE OF THE ECLIPSE EA-500 
SEPTEMBER 17, 2008 


> I welcome everyone to our Subcommittee hearing on FAA 


Aircraft Certification: Alleged Regulatory Lapses in the 


Certification and Manufacmre of the Eclipse EA-500. 


^ For the past few years, I have asked the question — does the 
Federal Aviation Administration (FAA) have adequate 
resources to accomplish its mission and in turn, are they 
relying too heavily on its safety record in order to 
demonstrate its abiUty to keep a safe system? Over these past 
two years, our hearings in the Aviation Subcommittee and the 
full Committee have demonstrated an agency that is short on 
resources, low in morale, and incapable of adequately 
overseeing its critical safety programs. 


1 
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Today, the Department of Transportation Inspector 
General’s (IG) report details alarming problems within the 
FAA. 

> I am extremely disappointed that the FAA again lacks the 
ability to oversee its programs — in this case its certification 
programs. Unformnately, this hearing will expose an agency 
that is as interested in promoting aviation and befriending 
manufacmrers as it is in carrying out its number one 
responsibility of protecting safety and the fljdng public. 

^ It is inexcusable and unacceptable to ignore rules, regulations 
and standard practices to accommodate those you have a 
responsibility to regulate — when you have people’s lives in 
your hands! This Subcommittee, the Congress and the 
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^ The aircraft certification and production process is 
complicated, requiring very technical expertise and 
understanding. When trying to do so on an emerging, new 
class of Very Light Jets (VLJs), like the Eclipse EA-500, one 
would expect the FAA to provide an appropriate amount of 
time and resources to make sure “we get it right.” However, 
questions have been raised by the IG and by current and 
former FAA employees that corners were cut during the 
certification and manufacturing process; deficiencies were 
overlooked; and this new type of aircraft was pushed through 
the process in order to meet internal agency goals. 
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^ As a result, the hearing today focuses on two central 

questions: did the FAA follow its regulations when certifying 
the Eclipse EA-500 — and in production of this aircraft? And 
was safety compromised? 

^ The IG, Calvin Scovel, will provide testimony which details 
serious issues with FAA’s certification and manufacture of 
the Eclipse EA-500. 

^ One of the most disturbing findings to me in the IG’s report 
is that instead of mandating that problems be resolved, the 
FAA accepted “lOUs” from Eclipse to resolve the problems 
at a later date. In this case, an “lOU” was allowed on the 
avionics system that ran the plane. I question the practice of 
using “lOUs” in any instance. However, to use an “lOU” on 
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^ It gets worse — according to the FAA’s own testimony on 
page 10 and 11, Eclipse delivered 11 EA-500 to customers 
prior to the completion of the “lOU” on this critical avionics 
system. In an exchange of letters which I will submit for the 
record. Eclipse was to “retain control of the aircraft” until the 
issue was closed out. Clearly, that did not happen. 

^ The IG wiU also testify that thirteen known deficiencies were 
unresolved when the FAA approved a production certificate. 
That is unprecedented and a direct violation of regulations; 
and yet, the FAA allowed it. EcUpse repeatedly 


5 



90 


^ Further, there is evidence to surest that the FAA developed 
an inappropriate relationship with Eclipse, forcing FAA 
employees to expedite the Eclipse EA-500 aircraft through 
certification and the production approval process, even 
though serious concerns were raised. 

^ I have said time and again safety cannot be compromised. In 
this case the FAA is treating manufacturers like “customers” 
instructing its employees to “build relationships with our 
customers” instead of acting as regulators. For example, the 
FAA’s own test pilots said the EA-500 should not be certified 
as a single pilot plane because of in-flight concerns such as 
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The FAA should be vigilant in ensuring the highest level of 
safety and be willing to slow down the certification process 
and shut down production if such action is warranted to 
protect the flying public. Deadlines and goals should have 
been adjusted once deficiencies were found. 

Finally, we have seen a pattern at the FAA of an agency that 
is reactive — not proactive. Only after getting briefed by the 
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^ It is not enough to have safety regulations in place. The FAA 
must enforce those regulations. 


y This Subcommittee has made safety a top priority and the 
FAA and manufacturers must do the same. We cannot have 
the agency responsible for aviation safety rely on the past or 
overlook problems by rushing certification in an effort to 
meet self-imposed goals. We expect and deserve more! 
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> With that, I want to again welcome the witnesses today and I 
look forward to the testimony. 

> Before I recognize Mr. Petri for his opening statement, I ask 
unanimous consent to allow 2 weeks for all Members to 
revise and extend their remarks and to permit the submission 
of additional statements and materials by Members and 
witnesses. Without objection, so ordered. 
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Statement of Rep. Harry Mitchell 
House Transportation and Infrastructure Committee 
Subcommittee on Aviation 
9/17/08 


-Thank you Mr. Chairman. 

—Last spring, we learned that individuals at the Federal Aviation Administration (“FAA”) 
allowed thousands of commercial airline passengers to fly on planes long past their 
inspection deadlines. The lapses put an estimated 13,000 Sky Harbor passengers at risk. 

“At the time, we were warned about an allegedly overly cozy relationship between 
individuals at the FAA and those at the airlines that they are supposed to regulate. 

“As we hear today’s allegations of still more FAA safety-related missteps, I am 
concerned that we may not have reached the bottom of these allegations of coziness. 

—We will hear from the U.S. Department of Transportation’s Inspector General (IG) 
about the FAA’s decision to award certification to a new aircraft, the Eclipse EA-500, 
“even though there were known deficiencies in its supplier and quality control systems.” 

—If true, this is very disturbing. 

-I look forward to hearing from our witnesses. At this time, I yield back. 
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Statement of 

The Honorable James L. Oberstar 
Subcommittee on Aviation 
Oversight and Investigations Hearing on 
“FAA Aircraft Certification: Alleged Regulatory Lapses in the Certification 
AND Manufacture of the Eclipse EA-SOO” 

September 17, 2008 


Today’s hearing continues a long history of oversight investigations by the 
Committee on Transportation and Infrastructure aimed at protecting those who rely 
on our Nation’s transportation system. Today we will hear the results of an 
investigation into allegations that the Federal Aviation Administration (FAA) rushed 
to approve both the type (TC) and production certifications (PC) of a new aircraft, 
the Eclipse EA-500, despite safety concerns raised by a number of FAA certification 
engineers and aviation safety inspectors over the design and manufacture of the 
aircraft. 


We win again hear from dedicated professionals, who had the courage to work 
with the Inspector General of the Department of Transportation (DOT) and our 
Committee— professionals who want to make air travel safe for all. There are 
disturbing similarities between the testimony we will hear today, and the hearing we 
held on April 3'‘' involving regulatory abuses at the FAA office charged with 
overseeing Southwest Airlines. Once again, we will hear how the FAA’s “ Customer 
Service Initiative” mistakenly treats those who are the subject of regulation as the 
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“customer,” and how it has the potential to create conflicts with the FAA’s one and 
only mandate— safety . 

I fear that complacency may have set in at the highest levels of FAA 
management, reflecting a pendulum swing away from vigorous enforcement of 
compliance, toward an industry-favorable, cozy relationship. This time it involves a 
manufacturer instead of an airline. 

In this case, the FAA remains steadfast in its assertion that no Federal 
regulations were violated. However, when the findings of this investigation are 
viewed in total, there is a disturbing suggestion that there was another “cozy 
relationship” and reduced level of vigilance on the FAA’s part during the process of 
approving the type certificate and the production certificate of the Eclipse EA-500. 

With the significant risks posed by a new aircraft, powered by new technology, 
and produced by a new manufacturer, it seems logical to have expected the FAA to 
exercise much greater scrutiny than in the typical certification program with an 
established manufacturer such as Airbus, Boeing, Cessna, etc. Moreover, the EA-500 
represented an entirely new class of aircraft, and did not easily fit into the FAA’s 
normal certification regime. The EA-500 has advanced avionics and turbine engine 
technology more characteristic of a large transport aircraft. Its only commonality with 
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a typical general aviation aircraft is its light weight and small passenger capacity. 
However, the FAA chose to use certification requirements for general aviation aircraft 
rather than the more rigorous requirements that should be required of aircraft with a 
greater degree of complexity. 

Instead, FAA seems to have been unusually lenient given the priority it 
assigned to the Eclipse certification project and the collaborative relationship that was 
developed with Eclipse management. FAA actually had the audacity to put in its 
performance plan that the Eclipse would be certified by September 30, 2006, and it 
did everything in its power to make sure it met that date, including signing type 
certificate approval exactly on September 30, 2006— a Saturday, and also the end of 
Fiscal Year 2006. coincidentally . How could the FAA possibly know when the 
aircraft would be ready for certification? 

It seems entirely illogical and inappropriate for senior FAA management to 
assign itself a date by which an aircraft is to be ready for certification approval and 
then to find reason to actually meet that date, when just days prior, numerous FAA 
personnel believed there was overwhelming evidence that the aircraft was not ready 
for certification. On the contrary, it would appear that the burden of when an aircraft 
is ready to be certified should fall entirely upon the manufacturer, and it should be 
none of FAA’s concern as a matter of policy. It is clearly not the FAA’s responsibility 
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to meet a manufacturer’s certification deadline, which is used to satisfy potential 
customers and company investors. The FAA’s only responsibility should be to 
respond in a timely fashion to an applicant’s approval documentation and to provide a 
“yes” or “no” decision on whether an aircraft is ready for safe certification. 

It is also interesting to note that the FAA Rotorcraft Certification Directorate 
in Fort Worth, Texas, which was assigned primary responsibility for evaluating the 
EA-500, appears to have been very diligent in its attempt to adhere to established 
certification regulations and appears to have performed admirably. However, their 
decisions and recommendations were routinely overruled by higher-level FAA 
management, with “customer service” to Eclipse looming as a strong influence. 


Congress removed “promotion of aviation” from the FAA’s mandate in 1996. 
The FAA’s recent behavior suggests that the promotion of aviation is stiM an integral 
part of FAA’s culture. 

In the Eclipse case, it appears that when design deficiencies were identified that 
appeared to be non-compliant with FAA certification requirements, senior FAA 
management became personally involved, overruled lower-level engineers and 
inspectors, worked diligently to find “work-arounds,” to find “alternative approval 
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rationales and techniques,” and to accept “lOUs” for later compliance. In many 
ways, the certification process in this case was conducted “backwards” from the clear 
intent and requirements of FAA certification regulations. Instead of certifying on the 
basis of safety alone, FAA senior management appeared to be highly motivated to 
find ways to explain why design deficiencies identified by FAA engineers and 
inspectors as “unsafe” were indeed “flawed,” but they were still “acceptable for 
certification” by simply changing the approval criteria. Indeed, one broad policy issue 
that needs further examination relates to the many “loopholes” FAA has at its 
disposal to find “alternative means of compliance” or “equivalent levels of safety” for 
certification regulations. Thus, the allegations and findings in this case are cause for 
concern and suggest the immediate need for a broad policy review of FAA 
certification practices. 

I look forward to hearing the testimony of all of the witnesses today. 
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Congresswoman Laura Richardson 
Statement at Transportation and Infrastructure 
Subcommittee on Aviation Hearing on 
“FAA Aircraft Certification: Alleged Regulatory 
Lapses in the Certification and Manufacture of the 
Eclipse EA-500” 

Wednesday, September 17, 2008 
2167 Rayburn House Office Building-10;00 A.M. 


Mr. Chairman, I want to thank you and Ranking 
Member Petri for holding today’s hearing on the 
certification and manufacture of the Eclipse EA- 
500 aka VJL (Very Light Jet). 

I understand that VJLs are intended to have 
lower operating costs than conventional jets, and 
are able to operate from runways as short as 
3,000 feet. Very Light Jets can bring an aircraft 
option to those areas that are ignored by 
commercial airlines and provide a faster option 
of means of transportation for short- distance 
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trips. However, I also understand that the 
creation of a Small Aircraft Transportation 
System needs to be held to a higher standard. 

The purpose of today’s hearing is to determine if 
proper oversight has been applied to the Very 
Light Jet by the F AA. 

If and when consumers decide to secure private 
options for air travel, consistent safety measures 
must be taken when it comes to flying. It is our 
job in the committee to get accurate facts on 
whether or not safety measures were taken when 
it came to the manufacturing and certification of 
the Very Light Jet. 

I look forward to hearing from today’s witnesses 
and I thank them for joining us here today. 
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Thank you, Mr. Chairman. 



103 


Testimony of Peg Billson 

President and General Manager, Manufacturing Division 
Eclipse Aviation Corporation 

House Transportation and Infrastructure Subcommittee on Aviation 
“FAA Aircraft Certification: Alleged Regulatory Lapses 
in the Certification and Manufacture of the Eclipse EA-500” 
September 17, 2008 


Chairman Costello and Members of the Subcommittee, thank you for the opportunity to 
testify today on the certification process of the Eclipse 500 and its unmatched safety 
record. 

I am currently President and General Manager of the Manufacturing Division at Eclipse 
Aviation Corporation (Eclipse), located in Albuquerque, New Mexico. In this capacity I 
am responsible for the company’s engineering, supply chain, quality, production and 
flight operations. From 2005 to until last month I served as Eclipse’s first Chief 
Operating Officer. 

1 have bachelor and master degrees in aerospace engineering and have worked in the 
aerospace industry for more than 25 years. The majority of my experience includes 
providing leadership for the design, build and in-service support of commercial airliners. 

I am also an instrument rated pilot with more than 80 flight hours in the Eclipse 500 
alone. 

Prior to Eclipse, 1 served at Honeywell International’s Aerospace Division in a variety of 
positions, including Vice President of Airframe Systems, Vice President of Aircraft 
Landing Systems and Vice President of Engineering for Engines, Systems and Services. 
Prior to Honeywell, I spent thirteen years at McDonnell Douglas Corporation, leaving as 
Vice President of the MD-1 1, MD-80 and MD-90 Commercial Aircraft programs. 

I am very proud to have played a lead role in bringing the Eclipse 500 — the world’s first 
very light jet — to market. Eclipse is currently the world’s leading VLJ manufacturer 
and has delivered more than 250 aircraft in 21 months of deliveries. 

Eclipse Aviation was founded under the thesis that by providing remarkably lower costs 
of jet transportation, new markets, new companies and new jobs could be created in 
American communities that could benefit from point-to-point air transportation. In 
addition to being the most fuel-efficient and environmentally-friendly jet available, the 
Eclipse 500 has technology and capabilities normally found in jets costing millions of 
dollars more, including the latest from Boeing Commercial Airliners. The Eclipse 500 
has an acquisition cost dramatically lower than any other jet and empirical data 
demonstrates that its total operating costs are the lowest of any jet available. This 
breakthrough has made the benefits of jet transportation available to more people than 
ever before and inspired an emerging generation of entrepreneurs to create a new form of 
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air travel — the air taxi. The Eclipse 500 also opened up a new world of convenient air 
transportation to communities in the United States that are experiencing a decline in 
commercial service or are simply not served by commercial airlines, thereby enabling 
economic growth in these areas. 

With me today is Eclipse’s new CEO, Roel Pieper. Mr. Pieper replaced Vern Raburn, the 
founder of Eclipse Aviation in July of this year and is providing leadership and 
experience in taking Eclipse to the next level of growth and operational excellence. Mr. 
Pieper has extensive executive experience in both the United States and Europe. He is 
also the Founder and Chairman of the European Technology and Investment Research 
Center (ETIRC) Aviation, a company which provides European business communities 
with affordable, on-demand air-taxi jet travel. 

We are proud of what Eclipse has accomplished, proud of the safety record the Eclipse 
500 has earned to date and proud that we deliver unprecedented performance, reliability, 
training and service to general aviation. We also are proud that Eclipse employs more 
than one thousand New Mexicans who manufacture and support the Eclipse 500; plus 
facilitating thousands of additional jobs at our suppliers throughout the United States. 

Designed and Tested with Safety as Top Priority 

In more than 32,000 total fleet hours — including more than 5,000 flight test hours — 21 
months of customer deliveries and with more than 250 aircraft delivered, no injury or 
fatality to any Eclipse 500 pilot or passenger has ever occurred. No other aircraft in two 
decades has entered service with a better safety record. 

We believe Eclipse 500's safety record is unprecedented for a new Federal Aviation 
Regulation Part 23 (General Aviation) aircraft. Our claim that the Eclipse 500 is the 
most-tested and safest general aviation aircraft can be substantiated by reviewing the 
following: 

• From its suite of advanced avionics, to the structural makeup of the airframe, 
safety was the overriding tenet of Eclipse’s design philosophy for the Eclipse 500. 

• To meet the FAA’s stringent certification requirements. Eclipse assessed the 
Eclipse 500’s performance and safety across thousands of test points, many in 
excess of what is required under FAR Part 23. 

• The average number of hours accumulated by a test fleet during FA A certification 
is 1 , 1 00 hours. The Eclipse 500 test fleet accumulated more than 5,000 hours 
prior to FAA type certification. 

• The Eclipse 500 state-of-the-art cockpit is designed for safety through the 
redundancy of vital systems and its ability to reduce a pilot’s workload. To 
ensure availability of critical flight data, the Eclipse 500 is equipped with 
redundant, high reliability, solid state electronic sensors and displays. 

• Eclipse exceeded FAA requirements during static testing of the Eclipse 500 
airframe. During these tests, limit loads — as well as ultimate loads — were 
placed on the airframe. The airframe met all test points on the first test; a 
testament to the structural integrity of the aircraft. 
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• Eclipse worked with specialists from 10 different FAA Aircraft Certification 
Offices (ACOs) and cross-flinctional FAA departments. The company was 
among the first to follow the FAA Certification Process Improvement (CPI) 
program. Detailed FAA involvement in a certification process is a hallmark of 
the CPI program. 

• The CPI program allows the FAA to focus on safety-critical or unique design 
features as they are being created. Eclipse shared these and the preliminary design 
concepts of the Eclipse 500 with the FAA well in advance of the flight testing 
portion of the certification process. 

• From the company’s inception. Eclipse has intended to conduct its own flight 
training curriculum to ensure a stringent and thorough process is followed to meet 
all FAR Part 142 requirements. Eclipse is the first U.S. aircraft manufacturer to 
employ a FAA-approved Flight Operational Quality Assurance (FOQA) program 
for its pilots and customers. FOQA is a voluntary program involving the routine 
analysis of aircraft data for operational risks and has been identified as a key 
contributor to superior safety records in Part 121 scheduled air carrier Safety 
Management Systems (SMS). 

Challenges in Achieving Type Certification ITC) 

The FAA type certification process for a new aircraft is the culmination of years of hard 
work from hundreds of people from many companies and government agencies. Gaining 
certification requires hundreds of certification tests and substantiation reports and 
thousands of testing hours conducted under the scrutiny of the FAA. Our certification 
process for the Eclipse 500 was instigated long before 1 came to Eclipse. As a result, 
there may have been several personnel changes during the course of the process that I and 
other members of the current Eclipse Aviation leadership team were not aware of. 

Eclipse cooperated fully with the FAA during the certification process we undertook. 

We received the provisional type certification (TC) for the Eclipse 500 in July 2006. It 
had been the intention of Eclipse management to reach full type certification in time to 
announce this milestone at EAA’s AirVenture in Oshkosh, Wisconsin. Shortly before 
AirVenture it became evident that the Eclipse 500 would not achieve TC by the event 
because we had not yet demonstrated compliance to every regulation, specifically the fuel 
tanks on the wing’s tip. Thus, Eclipse requested and received a provisional TC based on 
what it had accomplished. 

Receiving the provisional TC was a significant milestone for the company because it 
demonstrated to our customers and our employees just how close we were to finishing the 
entire type certification process. Eclipse never used this provisional TC for any other 
purpose than as a milestone. We did not present any aircraft for a Certificate of 
Airworthiness (C of A) or operate any aircraft under the provisional TC. 

Two months later. Eclipse was indeed able to show full compliance to the regulations and 
the Eclipse 500 received the standard type certificate on September 30, 2006. 
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Challenges in Achieving Production Certification (PC> 

To receive a Production Certificate (PC) a company must demonstrate that it has rigorous 
manufacturing and quality processes in place to repeatedly produce the design that was 
certified. A company is not required to obtain a PC to produce airplanes. It was 
Eclipse’s intent to obtain a PC directly after the TC. However, Eclipse and the FAA 
worked through a number of challenges before receiving the PC on April 26, 2007; seven 
months after receiving the full TC. 

In hindsight, it is not surprising that it took us seven months past our TC and more than a 
year in total to receive our PC. We were a new company with a new design, new 
manufacturing process and, although most had extensive previous experience, we were a 
combination of people working together for the first time. We experienced challenges 
getting all of these processes working in unison. 

In addition, it is rare for a new PC to be granted and therefore the experience with such 
things is limited within the FAA. We believe that the FAA did not initially have the 
people with the appropriate knowledge and experience assigned to our PC team. After 
repeated contradictory directions and lack of clarity around the approval process. Eclipse 
management expressed concern to FAA senior management that ongoing issues affecting 
granting Eclipse’s PC were not correctly addressed. The FAA assigned an independent 
board comprised of technical personnel with exceptional experience to oversee the PC 
process — with the assistance and full involvement of the existing FAA leadership. 
Together, Eclipse, the independent and experienced board and our assigned FAA officers 
executed the PC project plan as outlined in the FAA regulations. After demonstrating 
compliance to the regulations, we were granted our PC on April 26, 2007. 

Approval of Our Pilot Training Program Through the Flight Standards Board 
£FSBi 

FAA regulations require that a pilot of a Jet aircraft must be rated in that type of aircraft. 
This is called a Type Rating. A Flight Standards Board (FSB) is convened by the FAA 
once an aircraft is certified to evaluate and approve the pilot training program for a 
particular aircraft. The Eclipse 500 program was no different. To date 375 people have 
passed their FAA check ride and have received their Eclipse 500 Type Rating. 

There has been much discussion regarding our interaction with the FAA’s FSB. 

Between September 23, 2006 and December 13, 2006 Eclipse experienced two false 
starts with the FSB. On these two occasions Eclipse proceeded through the FSB process 
with a premature aircraft and the FAA correctly ceased the process until a completed 
aircraft could be presented. However, between January 16, 2007 to January 26, 2007, 
Eclipse provided the FSB with a complete and reliable production aircraft. With this 
aircraft the board was able to complete its evaluation of the pilot training program for the 
Eclipse 500. 
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It’s important to highlight that during this timeframe. Eclipse was still a developing and 
young company coming to grips with aircraft production best practices. At the time, we 
did not fully understand the value of using a fully production representative aircraft for 
this approval. In hindsight, a more prudent eourse would have been to attempt approval 
once our aircraft matured to a certified level. 

In-Service Experience of the Eclipse 500 

Again, in more than 5,000 flight test hours, more than 32,000 total fleet flight hours, 21 
months of customer deliveries and with more than 250 aircraft delivered, no injury or 
fatality to any Eclipse 500 pilot or passenger has occurred. No other aircraft in two 
decades has entered service with a better record. However, as with any new design, we 
have had issues with the reliability of some of our systems and components. 

There are several ways to document the initial in-service record of a new aircraft. 

• A Service Difficulty Report (SDR) is required by FAA Part 135 regulations for 
on-demand air carriers and Part 121 scheduled air carriers to report the occurrence 
or detection of failures, malfunctions or defects in an aircraft concerning 16 very 
significant events. By contrast, most privately operated aircraft, such as business 
jets, are not subject to the same stringent reporting requirements. The FAA 
instituted the SDR process to analyze and identify safety trends. An aircraft 
operator sends the SDR to the FAA for recording. 

• A Service Bulletin (SB) is a path for aircraft and systems manufacturers to alert 
operators and customers to a change or update to an aircraft or how it is operated. 
Manufacturers can issue an SB to proactively inform operators and customers of 
changes or updates. Manufacturers are responsible for notifying operators and 
customers of an SB and its requirements. 

• An Airworthiness Directive (AD) is the only mechanism that the FAA can use to 
mandate a change or inspection of the type design for aircraft that have already 
received a standard Certificate of Airworthiness. When an AD is published, the 
FAA sends the AD to all U.S. registered owners of an aircraft. 

Service Difficult Reports (SDRs) 

To date, 94 SDRs have been filed by Eclipse 500 operators since the aircraft was 
certified. Ninety-three (93) of these were filed by Day Jet Corporation, the largest 
operator of the Eclipse 500 (28 aircraft) and the nation’s first per seat, on-demand air taxi 
service. 

Eclipse has analyzed the 93 SDRs submitted by DayJet and has concluded that only one 
meets the requirements of an SDR. It is our assessment that DayJet went beyond the 
required reporting requirements of significant difficulties and chose to report through the 
SDR process additional maintenance events and other issues. We believe DayJet did so 
out of an overabundance of caution and a certain amount of inexperience with the SDR 
process in an effort to build robust communications with its FAA Flight Standards 
District Office (FSDO) in Washington D.C. 
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Eclipse, as required, has a very robust process in place to review, disposition and act 
upon all SDRs. Our SDR review process is performed on an ongoing basis by a cross- 
functional group familiar with the design of the Eclipse 500. This group includes 
engineers, aircraft system leads, and Designated Engineering Representatives (DERs). 
The group makes individual recommendations for dispositions of the SDRs to the FAA. 
To date, 59 of the 94 SDRs have been recommended for closure to the FAA. 

NTSB Investigations 

Since entering service the Eclipse 500 has been the subject of two investigations by the 
National Transportation Safety Board (NTSB). The preliminary reports have been 
released on both; one is classified as an incident and one as an accident. 

The incident occurred on June 5, 2008 at Midway Airport in Chicago, Illinois. The root 
cause of this incident was a flaw in the requirement for the software logic in the engine 
control system. This requirement was established at least two years prior to certification 
of the type design. The aircraft system during the incident performed exactly the way the 
software had been designed and certified to perform and was not the result of any 
hardware failure. Two teams of experienced engineers at Pratt & Whitney Canada (the 
engine manufacturer) and Eclipse Aviation — plus two certifying agencies; The FAA 
and Transport Canada — missed this requirement flaw. It was simply human error. 
Eclipse Aviation, along with the FAA, has taken action to ensure the continued safe 
operation of the Eclipse 500 while changes are being made to the software logic. 

The accident occurred on July 30, 2008 in West Chester, Pennsylvania. A pilot operating 
an Eclipse 500 overran a runway at Brandywine Airport while landing. The preliminary 
NTSB report states that “No preimpact mechanical failures of the flight control system, 
brake system, engine control systems, or engines were discovered.” After leaving the 
runway, the aircraft traveled down a 40-foot embankment and crossed a service road 
before coming to rest against a bank of trees and a chain link fence about 184 feet past 
the end of the runway. The aircraft was substantially damaged, yet the pilot and his 
young child were not injured. In fact, the aircraft cabin interior showed almost no signs 
of damage. This is a further testament to the design integrity of the Eclipse 500. 

In Service Reliability and Improvements 

The responsibilities of introducing a new aircraft are immense. Eclipse employs a variety 
of methods and systems to mitigate and prevent any service issue and to continually 
improve our aircraft. The aircraft possesses an electronic ecosystem that, for the first 
time in a FAR Part 23 aircraft, supports real-time communication about operating 
parameters. Thus, DayJet, as well as other Eclipse 500 operators, are now receiving data 
from the aircraft’s advanced software and technical systems regarding systems health, 
troubleshooting and fault isolations. The aircraft’s systems and equipment were designed 
to prevent cascading failures and limit the effects of single failures to manageable results. 
Extensive fault insertion testing and safety analysis prevents serious failures in the 
aircraft systems and equipment. The positive results of this design assurance program 
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have been proven throughout the continual examination of in-service difficulties of the 
Eclipse 500. 

Eclipse employs a number of internal methods to identify, analyze and address in-service 
difficulties to ensure the continued airworthiness and safety of the aircraft. Two of the 
most notable are the internal Safety Review Board (SRB) and the review of the 
previously mentioned Service Difficulty Reports (SDRs). 

The SRB consists of representatives from Flight Operations/Safety, Aircraft/System 
Safety, Quality Assurance, Engineering, Certification and Customer Support. This group 
also involves additional specialists for each situation and develops required containment 
actions for fielded aircraft concerns. In addition to the SRB and SDR reviews, an internal 
Reliability and Maintainability group evaluates the overall reliability of the aircraft and 
performs in-depth Root Cause and Corrective Action (RCCA) analyses as part of our 
overall Failure Reporting and Corrective Action System (FRACAS). The outputs of 
these efforts drive changes to the production process and, in some cases, design changes 
to improve the reliability of the aircraft. 

Summary 

Eclipse Aviation is dedicated to ensuring our aircraft and customer pilots are the model 
for general aviation safety. We have challenged the industry status quo by embracing 
technology and programs enabling comprehensive data collection, while shouldering 
the responsibility of continuously and proactively improving the Eclipse 500 and how 
it is operated. As a result, the Eclipse 500 was built to deliver exceptional safety 
performance. Its standard safety features rival those of aircraft costing millions of 
dollars more. The state-of-the-art Eclipse 500 cockpit is designed for safety through 
the redundancy of vital systems and its ability to reduce pilot workload. 

Mr. Chairman and Members of the Subcommittee, Eclipse did something no other 
company has accomplished. We developed a truly revolutionary aircraft and created a 
new market segment that helped return relevancy and growth to general aviation. In 
the process, we created something much more difficult than an airplane; we created a 
blue chip company with more than 1,000 employees, all dedicated to building the best 
jet in the history of general aviation. We look forward to delivering unprecedented 
performance, reliability, training and service to general aviation and to our customers 
for many years to come. 

Thank you for your time today. I will be pleased to answers any and all of your 
questions. 


Respectfully submitted. 


Peg Billson 
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ECLIPSE 

AVIATION 


October 16, 2008 


Honorable Jerry F. Costello 
Chairman 

Subcommittee on Aviation 
586 Ford House Office Building 
U. S. House of Representatives 
Washington, DC 205 IS 

Dear Chairman Costello; 

Thank you for your October 1” letter requesting additional information from the Eclipse 
Aviation Corporation (“Eclipse”) concerning the Federal Aviation Administration’s 
(FAA) certification of the Eclipse 500. 

As you my recall from my recent testimony before the Subcommittee, the Eclipse 500 
has an unprecedented safety record for a new Part 23 (General Aviation) aircraft. In 
more than 38,000 total fleet hours and with more than 250 aircraft delivered, no 
injury or fatality to any Eclipse 500 pilot or passenger has ever occurred. No other 
aircraft in two decades has entered service with a better safety record. 

From its suite of advanced avionics, to the stractural makeup of the airframe, safety was 
the overriding tenet of Eclipse’s design philosophy for the Eclipse 500. In order to meet 
the Federal Aviation Administration’s (FAA) stringent certification requirements. Eclipse 
assessed the Eclipse 500’s performance and safety across thousands of test points, many 
in excess of what is required under Part 23. We are proud that the Eclipse 500 test fleet 
accumulated more than 5,000 hours prior to FAA type certification (the average number 
of hours accumulated by a test fleet is 1,100). 

In fact, the FAA’s Special Certification Review (SCR) team, comprised of experts in the 
certification process, undertook an independent analysis of various issues regarding the 
type certification of the Eclipse 500. Last month, they reported their findings and 
reconfirmed that the Eclipse 500 was in full compliance with the FAA Certification 
requirements and is a safe aircraft. 

At it’s peak in July 2008, Eclipse employed over 2000 employees throughout the United 
States and over 2 times that amount at our suppliers. Over 90% of our suppliers are 
based in this country. We at Eclipse arc proud of the jobs we have created and the 
economic growth our airplane has enabled. 
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Thank you again for the opportunity to testify before your committee last month on 
behalf of one of the safest aircraft ever produced. 



President and General Manager 
Airplane Division 
Eclipse Aviation 
Attachment 



Attachment 


October 16, 2008 


FAA Aircraft Certification: Alleged Regulatory Lapses in the Certification and 
Manufacture of the Eclipse EA-500 

Questions for the Record 


QUESTION: As you know, the focus of the Committee and IG Investigations were 
not on Eclipse, per se, but were focused entirely osi the FAA. However, we have 
heard testimony from numerous witnesses, tliat Eclipse management, in particular 
the former CEO, repeatedly' appealed to senior management in Washington 
whenever they did not like what they were hearing from the regional certification 
office. Please comment? 

Eclipse Response; Eclipse followed the communications procedures set forth in 
the FAA Certification Process Improvement (CPI) program. Those procedures 
allowed us to work with, and communicate with, specialists from 10 different 
FAA Aircraft Certification Offices (ACOs) and cross-functional FAA 
departments. All communications with either the ACOs, or any other FAA 
personnel at any level, were consistent with the detailed level of FAA 
involvement in the certification process that is an essential element of the CPI 
program. 


QUESTION: The former Eclipse CEO, Mr. Raburn, seems to have been very 
aggressive in attempting to influence senior FAA managers in Washington. Did you 
observe this or otherwise have any knowledge that this was taking place? 

Eclipse Response: Other than the procedures referenced in our response to 
question 1, 1 have no knowledge of other communications by Mi-. Raburn with 
FAA personnel. 


QUESTION: Do you know how often Mr. Raburn contacted the FAA 
Administrator, Mr. SabatinI, or Mr. Hickey? 

Eclipse Response; I do not know. 


QUESTION: Did he have l outinc contact with any or nil of these officials? 

Eclipse Response: Other than the procedures referenced in our response to 
question 1 , 1 have no knowledge of other communications by Mr. Raburn with 
FAA personnel. 
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QUESTION: Was It a strategy of Eclipse mauagenient to appeal any adverse 
certification decision to senior FAA management? 

Eclipse Response: No. 


QUESTION: Did Eclipse have contractual obligations with investors that required 
it to receive FAA TC approval by September 30, 2006? 

Eclipse Response: No. 


QUESTION: What were the financial implications to Eclipse if you had not met 
that date? 

Eclipse Response; There was no direct financial implication to Eclipse if it had 
failed to receive FAA Type Certification for the Eclipse 500 by September 30, 2006. In 
fact, September 30th had never been established as a certification date. March was the 
original certification date; then May; then June; then September 22nd. We finally 
finished showing compliance to all of the regulations the following Friday. 

However, had the date been missed, Eclipse would have had to give certain customers 
who had placed deposits on the Eclipse 500 the right to terminate their deposit 
agreements and demand refund of their deposits. We camiot estimate how many 
customers, if any, would have elected to terminate their deposit agreements under this 
hypothetical circumstance. 


QUESTION: We are aware that at the time of type certification, Eclipse had only 
complied with 23 of 65 items required to certify the avionics software using the 
approved Industry standard (DO-178B). Is this why you pressured FAA to find an 
“alternative means of coiiiplinnce?” 

Eclipse Response; The FAA regulations do not allow for an “Alternative Means 
of Compliance” as part of the type certification process, so Eclipse did not request 
nor did the FAA grant one. Eclipse certified the avionics system by folly showing 
compliance to FAR 23.1301 or FAR 23. 1309. 
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QUESTION: Did Eclipse file a Customer Sen'ice Initiative appeal in Washington, 
when the FAA Flight Standardization Board refused to recommend the EA-500 for 
single pilot operation? 

Eclipse llespoBse: The Flight Standards Board (FSB) expressed concerns 
regarding the state of the autopilot functionality and questioned whether or not it 
met the regulations, A letter was sent to Janies Ballough from Vem Rabum on 
December 15, 2006, stating that 7» accordance with Federal Aviation 
Administration (FAA) Flight Standards Customer Service Principles, Eclipse 
Aviation is elevating our concerns regarding. ..we believe you [BalloughJ to be 
the next element in the chain of command. ’ Our letter outlined the process that 
was used during the type certification process to ensure that the single pilot 
workload was acceptable. 


QUESTION: How many EA-500s is DayJet operating today? 

Eclipse Response: None. DayJet has suspended its air taxi operations. 


QUESTION: How many totai EA-SOOs arc currently in routine operation? 

Eclipse Response: I am not sure of what is meant by “ routine ”, but there are 
currently over 225 Eclipse 500 aircraft in operation, which does not include the 28 
Eclipse 500 aircraft previously flown by DayJet. 
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AVIATION 


September 30, 2008 


The Honorable Jerry Costello 
Chairman 

Subcommittee on Aviation 
Committee on Transportation and Infrastructure 
U.S. House of Representatives 
Washington, D.C. 20515 

The Honorable Thomas Petri 

Ranking Member 

Subcommittee on Aviation 

Committee on Transportation and Infrastructure 

U.S. House of Representatives 

Washington, D.C. 205 1 5 


Dear Congressmen Costello and Petri: 

I would like to thank you again for the opportunity to testify on September I?"' before the 
Aviation Subcommittee regarding the certification of the Eclipse 500. 

1 have included two letters that 1 request be included in the official hearing record. They 
are: 


1. A letter to the Department ofTransportation’s Inspector General (IG) 
requesting that Eclipse Aviation be given the oppormnity to be formally 
interviewed by the IG’s office prior to his report being finalized. 

2. A letter to the Aviation Subcommittee on three specific issues Congressman 
Hayes asked Eclipse to clarify and address. 


Thank you. 
Sincerely, 



Peg l^iUpn 
President and General Manager 
Airplane Division 
Eclipse Aviation 
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ECLIPSE 

AVIATION 


The Honorable Calvin L. Scovel III September 22, 2008 

Inspector General 

U.S. Department of Transportation 

1200 New Jersey Avenue SW 

Washington, D.C. 20590 

Dear Mr. Scovel: 

I read and listened to your recent statement provided to the House Aviation Subcommittee 
on September 11* with great interest As Eclipse Aviation’s current President and General 
Manager of Eclipse Aviation’s Airplane Division and its Chief Operating Officer during the 
certification process (both type and production) of the Eclipse 500, 1 was personally 
involved in many of the issues you raised during your appearance before the Subcommittee. 

As I indicated during my oral testimony. Eclipse is disappointed not to have had an 
opportunity to be interviewed directly by your staff prior to the hearing and development of 
your public statement. As you know, IG personnel did make a visit to Eclipse in July 2008, 
along with FAA personnel, in order to access FAA files relating to the certification process 
of the Eclipse 500, At no time during this visit, however, did your staff interview Eclipse 
personnel with firsthand knowledge of the issues you are reviewing. 

Eclipse continues to be supportive of the ongoing review into the Eclipse 500 certification 
process. However, as the certification process is an intricate and complex process it is 
imperative that information presented to oversight authorities, such as our office, be 
accurate. In this regard, I was disappointed to see many of the facts and assertions in your 
testimony to be out of context and factually inaccurate. Given the opportunity to discuss 
the issues with your team, I am certain that a complete and accurate accounting of the 
various issues can be presented prior to your report being made final. 

I have outlined a few examples of inaccurate information presented in your statement: 

• Statement - The Eclipse 500 was designed for use on “soft fields” and certified tires 
not designed for hard, paved runways. 

Fact - The Eclipse 500 was not designed or approved for unpaved fields, nor was 
that capability ever sought in certification. The tires delivered on the Eclipse 500 
are not meeting their promised durability from the supplier and a change in tire 
type is in FAA certification testing now. 

• Statement - FAA granted ODAR status in 2002 before approving the design of the 
aircraft without the “proven experience to perform the functions requested.” 
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Fact - Eclipse received ODAR status on four items in 2002, all relating to suppliers. 
In fact. Eclipse did not receive full ODAR status until seven months after it received 
its Production Certificate. A neiv company does not equal inexperienced people. 

■ Statement - Eclipse applied and FAA approved an alternative means of compliance 
for the aircraft’s avionics software. 

Fact - The FAA did not use an alternative means of compliance to certify the 
Eclipse 500 's avionics software. Under FAA regulations, this is not possible. 
Actually, FAA approved the avionics software by showing compliance to 23. 1301 
and 23. 1309: the required regulations. 

* Statement - EASA has declined to certify the Eclipse 500 for operation in Europe. 

Fact - EASA has not declined to certify the Eclipse 500 and in fact, there is an 
agreed to line of sight to receive EASA certification, without restrictions within the 
next 60 days. 

• Statement - In interviewing Eclipse’s largest customer and operator of the Eclipse 
500, one pilot “lacked the confidence that the aircraft could be operated safely by a 
single pilot.” Therefore, it is recommended that the Single Pilot certification be 
reviewed. 

Fact - This is hearsay and selectively choosing the views of a single pilot to push 
for a review of the Single Pilot certification of the Eclipse 500. The Eclipse 500 's 
demonstrated safety record speaks to the fact that the aircraft ‘s fundamental design 
combined with Eclipse 's FAA approved training program is working today and 
producing the safest aircraft introduced into general aviation in the last twenty 
years. 

At this time, I would formally request that Eclipse be given the opportunity to be 
interviewed by your staff at the earliest possible date. As you move to conclude your 
investigation and finalize your report, I believe it is imperative that Eclipse’s perspective, 
views and facts be appropriately given adequate consideration. 

1 look forward to hearing from you or your staff shortly. 

Regards, 



Peg Mlson 

President and General Manager 
Airplane Division 
Eclipse Aviation 
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AVIATION 


September 30, 2008 


The Honorable Jerry Costello 
Chairman 

Subcommittee on Aviation 
Committee on Transportation and Infrastructure 
U.S. House of Representatives 
Washington, D.C. 205 1 5 

The Honorable Thomas Petri 

Ranking Member 

Subcommittee on Aviation 

Committee on Transportation and Infiastrucmre 

U.S. House of Representatives 

Washington, D.C. 20515 


Dear Congressmen Costello and Petri: 

1 am writing in response to a request made during the September 1 j"" hearing by 
Congressman Hayes that Eclipse Aviation (“Eclipse”) provide a letter to the 
Subcommittee addressing three items related to the certification of the Eclipse 500 - the 
throttle quadrant assembly, single pilot certification and the pitot-static ports. The 
Subcommittee requested that Eclipse describe how these issues were addressed during 
the certification of the Eclipse 500, any problems that arose and their ultimate resolution. 

I am happy to have the opportunity to provide the details surrounding these issues and the 
steps Eclipse took to resolve them. 

Throttle Quadrant Assembly 

On June 5, 2008 an Eclipse 500 on approach to Chicago’s Midway Airport experienced a 
thrust-lever failure involving software that caused uncontrollable maximum engine thrust. 
As outlined in the Eclipse 500 ’s emergency procedures manual, the pilots shut down one 
of the engines which immediately caused the second engine to begin idling and be 
unresponsive to the throttle. The pilots declared an emergency and landed the aircraft 
without injury. 

The root cause of this accident was a flaw in the requirement for the software logic in the 
engine control system. This requirement was established at least two years prior to 
certification of the Eclipse 500 type design. The aircraft system during the accident 
perfonned exactly the way the software had been designed and certified to perform and 
was not the result of any hardware failure. Two teams of experienced engineers at Pratt 
& Whitney Canada (the engine manufacturer) and Eclipse plus two certifying agencies - 
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the FAA and Transport Canada - missed this requirement flaw. It was simply human 
error. 

Shortly after the Chicago incident, Eclipse was in immediate contact with the FAA and 
quickly determined appropriate preventive action while a longer term fix for the software 
could be developed. Eclipse issued a Customer Pilot Communication on June 9, 2008 
advising operators not to use excessive force against the throttle forward stops. An 
Eclipse Service Bulletin was also issued to check the throttle quadrants on every Eclipse 
500 to ensure that reasonable forces against the forward stop would not result in 
exceeding the maximum allowed throttle angle. The FAA issued an Ainvorthiness 
Directive (AD) mandating compliance with the Eclipse Service Bulletin. In less than 24 
hours all Eclipse 500 fleet operators had compiled with the AD inspection requirement 
and were operating their aircraft nonnally. 

As a follow-on design improvement Eclipse and Pratt & Whitney Canada are proceeding 
with an engine control system software change to provide more margin between the 
maximum expected throttle angle for normal operation and the angle at which the system 
senses an out-of-range condition. The new software will also ensure complete separation 
between the left and right engine controls. The software change is expected to be certified 
and fielded later this year. 

The fact that the Eclipse 500 has experienced in-service difficulties warranting 
airworthiness directives does not imply that the aircraft was improperly certified. In fact, 
a comparison of the most recently introduced Part 23 (General Aviation) aircraft reveals a 
similar number of ADs and Service Difficulty Reports during delivery of their first 240 
aircraft (see attachment). The vast majority of jet aircraft experience service issues that 
result in airworthiness directives and corrective action. 

Sinele-Pilot Certification 

It was always the intent to have the Eclipse 500 certified as a single-pilot aircraft as is 
most FAR Part 23 aircraft. In 2006, Eclipse requested that the FAA certify the aircraft 
for Single Pilot Instrument Flight Rules (SIFR) operations. FAA’s Flight Standardization 
Board (FSB), which determines the pilot type rating of an aircraft, began its evaluation of 
this request. 

In September 2006 and again in December 2006, the FSB met twice to evaluate Eclipse’s 
pilot training program. In both instances Eclipse provided the FSB with a non-production 
representative airplane such that they w’ere not able to complete their evaluation. At the 
time, Eclipse did not fully understand the value of using a fully production representative 
aircraft for this approval. That was our mistake and the FSB correctly ceased its 
evaluation process until Eclipse addressed all outstanding issues. 

It is the issues identified during these two “false” starts that has confused some to 
conclude that the FSB recommended a two-pilot crew when in fact, when the evaluation 
was completed, a single pilot type rating was approved. In early 2007, we provided the 
FSB with a production compliant airplane and they were able to issue the SIFR 
operations type rating on January 26, 2007. Since then 432 people have passed their 
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FAA check ride and have received their Eclipse 500 type rating for single pilot 
operations. 

It should be noted that the Eclipse 500 is not alone in its single-pilot rating. The 
attachment lists a number of other similar Part 23 jets that are certified for single-pilot 
operations. Single-pilot operations has long been the norm in the industry. 

Pitot-Static Ports 

An aircraft’s pitot-static system is a system of pressure sensitive instruments that 
measures airspeed, altitude and rate of climb. Eclipse sought and received an 
“Equivalent Level of Safety” (ELOS) designation for the Eclipse 500’s pitot-static 
system. It is important to note that FAA regulations and order allow for special 
conditions, such as an ELOS, when an unusual design feature of an aircraft is presented. 

The Department of Transportation’s Inspector General (IG) has referred to problems with 
the Eclipse 500’s pitot-static system traced to “moisture build-up. . . due to the unusual 
placement of the static ports on the top of the aircraft nose and the lack of drainage.” 

Yes, it is factual that the Eclipse 500 has received a number of reported occurrences of 
alerts indicating a difference sensed between the left and right airspeed sensing systems. 
Moisture build up in the static system is suspected to be the cause of these discrepancies. 
Technical investigations have found that, although positive drainage exists, the system 
can be overwhelmed under certain conditions such as melting snow on the static ports or 
heavy rain. Eclipse is providing static port covers to our customers to protect against 
excessive water getting into the system. 

Regardless, it should be noted that the design of the EA500 includes a redundant and 
separate standby pitot-static probe that has always continued to provide airspeed and 
altitude information when anomalies in the primary system have occurred. 

The Eclipse family continues to be proud of bringing the world’s first very light jet to 
market. The Eclipse 500 has an unprecedented safety record for a new Part 23 aircraft. 

In more than 38,000 total fleet hours and with more than 250 aircraft delivered, no injury 
or fatality to any Eclipse 500 pilot or passenger has ever occurred. No other aircraft in 
two decades has entered service with a better safety record. 

Thank you again for the opportunity to provide these facts and our perspective on these 
issues. 



Peg Bill) on 

President and General Manager 
Airplane Division 
Eclipse Aviation 




No(e: The NTSS reports accidents and inddents during experimental lasing, aH data above reflects both delivered and flight test accidente/incidents/fatatities 
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AVIATION October 9, 2008 


The Honorable John Mica 
Ranking Member 

Committee on Transportation and Infrastructure 
U.S. House of Representatives 
Washington, D.C. 20515 

Dear Congressmen Mica: 

I am writing in response to your letter dated September 26, 2008 in which you request 
that Eclipse Aviation (“Eclipse”) respond to several questions raised during the course of 
the September 17, 2008 hearing regarding the certification of the Eclipse 500. 

I am happy to have the opportunity to provide Eclipse’s views and perspectives on these 
important issues. 

Is the EA-500 a safe airplane? 

The Eclipse 500 has an unprecedented safety record for a new Part 23 aircraft. In more 
than 38,000 total fleet hours and with more than 250 aircraft delivered, no injury or 
fatality to any Eclipse 500 pilot or passenger has ever occurred. No other aircraft in two 
decades has entered service with a better safety record. 

Therefore, without hesitation, I am confident and proud to state that the Eclipse 500 is 
one of the most-tested and safest Part 23 (General Aviation) aircraft. From its suite of 
advanced avionics, to the structural makeup of the airframe, safety was the overriding 
tenet of Eclipse’s design philosophy for the Eclipse 500. In order to meet the Federal 
Aviation Administration’s (FAA) stringent certification requirements. Eclipse assessed 
the Eclipse 500’s performance and safety across thousands of test points, many in excess 
of what is required under Part 23. We are proud that the Eclipse 500 test fleet 
accumulated more than 5,000 hours prior to FAA type certification (the average number 
of hours accumulated by a test fleet is 1,100). 

In fact, the FAA’s Special Certification Review (SCR) team, comprised of experts in the 
certification process, undertook an independent analysis of various issues regarding the 
type certification of the Eclipse 500. Last month, they reported their findings and 
reconfirmed that the Eclipse 500 was in full compliance with the FAA Certification 
requirements and is a safe aircraft. 
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In retrospect, what could have been done differently? 

Eclipse’s biggest mistake during the certification process was our lack of experience in 
dealing with the FAA’s Flight Standardization Board (FSB). By providing the FSB with 
a non-production representative airplane on two different occasions, wc contributed to the 
conftision surrounding the process by which the Eclipse 500’s was awarded its single 
pilot rating. 

If we had it to do differently. Eclipse would have waited and provided a production 
complete aircraft for the FSB to make their pilot training evaluation. 

Why did il take five years to cerlil\‘ the Eclipse 500? How lone should it take? 

The typical timeframe to develop and certify a completely new aircraft is betw’een 4 and 
5 years. Eclipse applied for a type certificate in July 2001. According to FAA 
regulations, type certification applications for aircraft like the Eclipse 500 are generally 
effective for three years. 

Eclipse’s 5 year certification process is largely due to the faulty engine originally 
envisioned for the Eclipse 500. Eclipse ended its relationship with Williams International 
in November 2002 after it became clear that the development of the engine for the 
Eclipse 500 was significantly behind schedule and was not going to meet the 
requirements of the aircraft. 

In February 2003, we announced a partnership with Pratt & Whitney Canada to develop 
the engine for the Eclipse 500. As a result of changing engine manufacturers, Eclipse 
experienced a delay of 24 months in its certification process. 

The process of delegation and alternative means of compliance is set up to recoenize the 
size, complexity and maturity of the industry oreanization beine reeulated and cerlifted. 

In your view is this an appropriate wav to see that safety is improved as lechnoloev 
improves? 

It is important to note that Eclipse did not seek nor did the FAA approve any Alternative 
Means of Compliance (AMOC) for the Eclipse 500, as reported in the Department of 
Transportation Inspector General’s (IG) testimony on September 17, 2008. According to 
FAA regulations, an AMOC can not be used during the certification process of an aircraft 
and therefore, was not used on the Eclipse 500. 

However, FAA regulations do allow an “Equivalent Level of Safety” (ELOS) designation 
to be used when new and unique design feanires of an aircraft are presented. ELOS 
designation was used on the Eclipse 500. Approval of an ELOS goes through strict 
scrutiny and is reviewed and approved by FAA’s Part 23 Standards Office in addition to 
the Aircraft Certification Office (ACO). 
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In our view, allowing the FAA and aircraft manufacturers the flexibility to achieve 
compliance with specific regulatory requirements is the best manner in which to ensure 
safety is improved as technology improves. 

Some have characterized "alleniative means of conmliance" as a "loophole. " Is that a 
far and correct represcniation? Can vou characterize the nesaiive effects to aviation is 
such alternative, means of conwiiaiice were not allowed? 

As 1 mentioned in my answer above, ELOS is fully explained in FAA regulations and 
FAA order. It is no loophole. While it makes sense for some aircraft manufacturers to 
follow published compliance methods, others may choose to meet and exceed regulations 
through a different process. Both approaches should be encouraged. I would argue that 
an ELOS designation invites more oversight, as additional experts review' the request in 
detail to ensure the highest level of safety is being sought for the flying public. 

We must maintain flexibility in the process and recognize the fact that the regulations 
will not satisfy nor keep pace with American ingenuity. ELOS allows such American 
creativity to continue to keep the U.S. as one of the world’s aeronautical leaders. 

Tliank you again for the opportunity to provide our perspective on these issues. Should 
you have any additional questions, please feel free to contact me. 



President and General Manager 
Airplane Division 
Eclipse Aviation 
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Committee on Transportation and Infrastructure’s Subcommittee on 
Aviation Regarding FAA Aircraft Certification: 

Alleged Regulatory Lapses in the Certification and Manufacture of the 
Eclipse Aviation EA-500 


Prepared by Witness Maryetta Broyles, 

Technical Program Management Specialist, Aircraft Certification Service, 
SW Region Rotorcraft Directorate, 

Manufacturing Inspection Office, ASW-180 

Maryetta.J.Broyles@faa.gov 

817-222-5183 


September 17, 2008 
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Opening 

Good morning. Chairman Oberstar, Chairman Costello, Congressman Mica, Congressman Petri, and 
Members of the Subcommittee. 

I am an Aviation Safety Inspector (ASl) in the Fort Worth Manufacturing Inspection OIBce of the 
FAA. One of my duties as an ASI, is to evaluate new and existing manufacturing companies that 
produce conunercial aircraft and new replacement parts for aircraft. 1 have been called to present the 
facts pertinent to the issuance of the Manufacture of the Eclipse EA-500 aircraft at Eclipse Aviation 
Corporation, located in Albuquerque, New Mexico. 

1 have worked for the FAA for 20 years. After coming to the FAA, I obtained my Airframe and 
Powerplant License. This required 3 years of night school while working full time. During my tenure 
as an ASI, I have performed over 485 evaluations including Aircraft Certification Systems Evaluation 
Program (ACSEP) of aircraft manufacturing facilities. As of this date I have been on three Production 
Certification Boards (PCB’s). The purpose of the PCB is to evaluate the eligibility of the applicant for 
issuance of a Production Certificate based upon the preliminary findings and recommendations of the 
of the Manufacturing Inspection District Office (MIDO) and the PCB’s review of the applicant’s 
facilities and Quality Control Data. 

Eclipse Aviation submitted an application for an Approved Production Inspection System (APIS). 

This was the first step in preparing Eclipse for a Production Certificate (PC). On July 10 through 21, 
2006, 1 was a team member for the APIS preliminary District Office audit at Eclipse Aviation. The 
team consisted of five members. This evaluation was to determine if Eclipse Aviation’s Quality 
System had the capability to comply with 14 CFR, Subpart F, §21.125. During the evaluation 15 
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noncompliances of the system were documented. The FAA sent a letter to Eclipse Aviation 
identifying the noncompliances, and requested corrective action. 

On September 15, 2006, Eclipse made application for a Production Certificate. On September 25, 
through 29, 2006, 1 returned to Eclipse, as a team member, to review the corrective actions from the 
previous July APIS preliminary District Office (DO) audit and to review the Functional Test 
Procedures for production aircraft serial number 000001 . When we arrived at Eclipse, corrective 
actions for the previous DO audit were not presented to us and had not been implemented. Since the 
corrective actions were not in place, we began our evaluation of the Functional Tests. The procedures 
were failing the review. The testes were written incorrectly, documentation was incomplete, and were 
not passing the specification requirements as documented. Once we determined the tests were not in 
compliance, the team leader switched the focus of the team to continue with the ongoing preliminary 
District Office audit. During this audit 20 additional noncompliances were identified. The FAA sent a 
letter to Eclipse identifying the noncompliances, and requested corrective action. 

During the September 2006, visit at Eclipse it seemed that the company was not seriously working 
toward corrective action of the noncompliances discovered from the July 2006, audit. The push was to 
get the first production aircraft certified rather than work toward corrective actions of the quality 
system. The more we tried to coach the company to correct the quality system, the more resistance 
there seemed to be. 

December 1 1 through December 20, 2006, 1 returned to Eclipse. The company’s focus had shifted 
from getting a Production Certificate to getting an airworthiness certificate issued on aircraft Serial 
Number 000001 . Eclipse sent corrective actions from the July and September audits to the FAA on 

November 1 6, 2006. These corrective actions were not verified because our management conveyed to 
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us that we were to work on nothing but the airworthiness of the aircraft. There were three inspectors 
on-site to complete 31 Functional Tests and verify the conformity of the aircraft to type design. 

Eclipse was to conduct all FTP’s prior to presenting the aircraft to the FAA for approval. The 
agreement in place between FAA and Eclipse was that the company would present a signed FAA Form 
8130-9, “Statement of Conformity” certifying that, the company had complied with 14 CFR, Subpart 
B, Section 21.33(a) which refers to Section 21.33(b) and states in part, “the applicant must make all 
inspections and tests necessary that materials and products conform to specifications, parts of the 
products conform to the drawings and manufacturing processes, construction, and assembly conform to 
those specified in type design.” When the FAA received the signed certifying documents, we would 
conduct all the Functional Tests on one aircraft. Once the first aircraft passed all the tests, we would 
look at fewer tests for the second aircraft, and even less on the third. When Eclipse demonstrated they 
could produce a conforming aircraft, we would allow the Organizational Delegation Airworthiness 
Representatives to conduct the conformity and inspection of the aircraft, The FAA would then spot 
check the aircraft and issue a Standard Airworthiness Certificate. 

Eclipse presented the aircraft to the FAA with a signed “Statement of Conformity” and we began 
conducting the tests. The tests failed repeatedly. During the December visit, we reviewed 28 of the 3 1 
Functional Tests. 1 1 of the 28 tests passed. Examples include: 

♦ The Cabin Pressure Vessel and Delta P Limiter was presented to the FAA five times. When we 
checked it on December 13, 2006, it failed again. 

♦ The BASS (VORE/FACV) & CCS Door Actuator was presented to the FAA four times and 
failed again on December 15, 2006. After three attempts, the test passed. 

♦ The Avionics RTS was presented to the FAA three times. When conducting the test the display 
panel went blank. When I asked the technician what happened, she stated “That happens all the 
time,” The test failed. 
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♦ The Landing gear System was presented to the FAA nine times before it passed the FAA 
review. 

Eclipse needed to rewrite some of the FTP’s to meet the requirements so the tests could be performed 
properly. 

I went on vacation the week following the trip to Eclipse and returned to work on January 3," 2007. 
When I returned I was informed that a Standard Airworthiness Certificate had been issued to aircraft 
serial number 000001 on December 31, 2006. This was surprising to me due to the numerous 
Functional Tests that had failed inspection and were incomplete when we left Eclipse on 
December 20, 2006, 

The July and September, 2006, audits documented 35 noncompliances. Eclipse sent corrective actions 
from the July and September audits to the FAA on November 16, 2006. These corrective actions were 
not verified. 

The official Production Certification District Office Audit was conducted February 5, 2007, through 
February 15, 2007. 1 was not on this team. The team documented 42 noncompliances during the audit. 
From July 10, 2006 to February 15, 2007, three audits of Eclipse Aviation’s quality system were 
conducted. A total of 77 noncompliances were documented. 

During my visits to Eclipse, I felt that Eclipse was controlling our schedules and managing FAA 
resources. An example of Eclipse calling the shots was when we called our manager and asked that we 
be allowed to return to Fort Worth one day early due the weather conditions. We were told to stay and 
complete our inspections. We continued with the inspection, while most of the Eclipse employees 

were told to leave due to hazardous weather. Another example; in April, 2007, Eclipse was preparing 
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an aircraft for certification. We were told by Eclipse to go back to the hotel and we would be on-call 
all weekend. They said it may be midnight before the aircraft was ready for certification, but whenever 
they called we should be ready. The aircraft was not ready for certification until the following week. 

On March 2, 2007, Manager, FAA AIR-1 appointed an independent team to oversee airworthiness and 
the Production Certificate for Eclipse. The Rotorcraft Directorate Manager was removed from the 
program and we were informed that the independent team leader was now managing the project. 

When the team leader took over, he removed the FAA Principal Inspector from the program. The 
project was then transferred from the San Antonio Manufacturing Inspection District Office (MIDO) to 
the Fort Worth MIDO. A MIO inspector was assisting the San Antonio MIDO with the transition to 
the Fort Worth MIDO. A short time later, the MIO inspector was removed from the project. 

In April 2007, 1 was selected to be a team member on the Production Certification Board for the 
issuance of the Production Certificate. The evaluation was conducted April 9, 2007, through April 16, 
2007. Sitting in the back of the room were five FAA managers. My Manager was assigned as the 
Production Certificate Board Chairman. During the internal FAA in-brief, the independent team leader 
spoke to the team and stated that Eclipse had been audited numerous times. He talked about how the 
company had improved since he had been appointed leader of the program. Because I had been to 
Eclipse on several previous occasions, I was surprised that they had made such a tum-around in just a 
few months. The independent team leader continued his briefing and stated that we were there to look 
at the quality system and determine if a Production Certificate should be issued. He stated that we 
should do a high level or overview of the system because the company had already been audited 
numerous times. It was then stated “in other words we need to only go an inch-deep when evaluating 
the quality system.” I was shocked when I heard this statement. I had never been told to go only an 
inch-deep when conducting an audit. Order 8120.2D, Production Approval and Certificate 
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Management Procedures, paragraph 48 b., stales that the applicant should be advised that the PCB is 
responsible for making a thorough evaluation of the applicant’s QC system/data, organization, 
production facilities, and if deemed necessary, supplier facilities. I remembered that Eclipse hadn’t 
provided corrective action for the first audit for 4 months and the second audit for 2 months. Then the 
focus shifted from audits to getting the first production aircraft certified and the corrective action fi'om 
the first two audits had never been verified. To do only an overview of the system when corrective 
actions were not verified and Functional Tests were failing was in conflict with our guidance. 

When the meeting was over I went to the production floor to conduct ray evaluation of the 
manufacturing system. I am a very thorough evaluator. During my evaluation I found issues with the 
Horizontal Stabilizer Assembly. The position light wire was crimped too tight, which could cause 
chafing. The bonding application on the de-ice boot was not fully covering the entire area 
approximately H-inch from the leading edge. These discrepancies should have been corrected before 
the Eclipse inspector signed it off. I requested the drawings to evaluate the condition further. When' 
looking at drawings, one drawing led to another and so on. My escort said to me “Maryetta you are 
going more than an inch-deep. You are going too deep.” I was surprised that my escort had heard that 
statement. I do not know how he received the same information that was briefed only to the FAA. 1 
acknowledged his remark. 

With the five managers sitting in the back of the room, taking notes on everything that was said, I felt 
as if we were being monitored on our performance. In all my years as an inspector for the FAA, I have 
never felt the pressure from FAA Managers that I felt when Eclipse was trying to get their Production 
Certificate, We were being monitored on our performance and tvith the removal of Managers and 
Inspectors from the project; 1 was cautious about what I said and did. I have successfully approved 
several other companies for production and have never experienced this level of involvement or 
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monitoring from Washington Headquarters. We followed our guidance and regulations and spent 
enormous amounts of time coaching and providing assistance to Eclipse. Issues were identified to 
prevent safety problems. We were directed to get the job done and money and resources was no 
object. I am proud to represent the FAA and be a part of a world-class organization in advancing 
aircraft safety. Our actions during this trying time were honest. 

One of the core values of AIR is to praise each other publicly, and recognize and regard others for 
excellence. I feel the inspectors were pressured and discredited when we were trying so hard to 
accomplish our job. 

This concludes my statement. 
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The National Air Traffic Controllers Association (NATCA) represents aviation safety 
professionals including the aerospace certification engineers, flight test pilots, and 
technical/administrative personnel in the Federal Aviation Administration’s (FAA) Aircraft 
Certification Division. In addition to my 20 years of service as an aerospace engineer at the 
FAA’s Chicago Aircraft Certification Office, I serve as the NATCA Aircraft Certification 
National Representative, 

The FAA Aircraft Certification Division is authorized by Congress with the inherently 
governmental mission of ensuring that aircraft are designed, analyzed, and tested to a minimum 
level of safety. Once proper testing and analysis are conducted, these engineers review the results 
and determine whether the aircraft is in compliance with safety regulations. If all regulations 
have been met, the FAA gives its seal of approval by issuing a type certificate (TC). Normally 
aircraft have various limitations, such as weight, performance, or life limits. These limitations 
are to be denoted in the type certificate data sheet (TCDS), flight manual, and maintenance and 
overhaul manuals. Some aircraft are approved with heavily restrictive limitations. This allows 
the aircraft to enter the market but only to be flown in a limited capacity, giving the company 
time to fix the remaining concerns. 

In the case of the Eclipse 500 Jet type certification project, safety, employee complaints, and 
undue FAA management pressure for speedy certification forced NATCA to file a grievance. 

All information discussed herein is produced under the protections of this hearing, applicable 
law, and Congressional authority. Information is presented in chronological order although some 
information may have been disclosed to the Union after the grievance was filed. 

Creating the Partnership Safety Plan 

According to the FAA’s type certificate data sheet (TCDS) for the Eclipse EA500 aircraft 
(referred to as a Very Light Jet), the application was dated in July of 2001 , but briefings to the 
FAA actually began in spring of 2001. As the Very Light Jet (VU) represented an entirely new 
aircraft design, Eclipse experienced issues with design development, testing and safety. As a 
result, the project was not completed within the standard three years' and the company applied 
for and was granted an extension. Although a second extension could have been granted, no 
such request was ever made. 

Responsibility for this project was initially given to the FAA’s Chicago Aircraft Certification 
Office (ACO) in conjunction with both the Williams Engine Company (Williams) and the 
Eclipse Aviation Corporation (Eclipse). During the project, the Chicago ACO employees were 
required by FAA management to create a Partnership for Safety Plan (PSP) with Eclipse - a plan 
that outlines the goals and procedures specific to this project - and complimentary Project 
Specific Certification Plan (PSCP) to support the PSP goals. This PSP outlined a number of 
procedures, timelines and goals that fell outside of the FAA’s authorization and other federal 
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aviation safety regulations. The need for a PSP or PSCP is only recommended by an FAA Order 
and is not required by law or regulation. 

Some troubling aspects of the Eclipse PSP and PSCP included: 

• A timeline that forecasted type certification by December 2003, highly aggressive for a 
new company and new aircraft design. 

• The FAA committed to “optimal delegation” to the “maximum extent practicable,” 
handing over much of their oversight and testing responsibilities to the company itself, a 
dangerous decision for such a new aircraft design. 

• Implications that Eclipse would have sole decision-making power over who would be the 
Administrative Designated Engineering Representatives (DERs). The PSP also assigned 
that the key representative for the Administrative DER position would be from the 
Williams Engine Company. 

• All Eclipse data would be returned to Eclipse after TC issuance and not maintained by 
the FAA. 

• Eclipse was allowed to appeal technical decisions to higher level FAA management and 
could limit when the FAA needed a safety concern document, such as a special condition 
or an issue paper. 

• The PSCP highlighted the dependence of Eclipse’s aircraft design on aviation equipment 
that had been granted a Technical Standard Order (TSO), By using TSO units throughout 
the aircraft, it shifts costs and pressure for certification onto the TSO company (supplier). 
In addition, the PSCP highlighted that the Williams engine and the Eclipse aircraft were 
highly integrated and interdependent. 

Pressure on Eclipse Engineers 

In November of 2002, the Williams engine was dropped from the aircraft design. In February of 
2003, the Pratt & Whitney of Canada (PWC) 610F-A engine was identified as the replacement 
engine. This was a major technical engineering design change and the whole propulsion and 
software integration system needed to be revamped. Despite the new need for additional 
research and design, the certification timeline did not change. Eclipse engineers and flight test 
pilots were then under extreme pressure to meet their business plans. For example, Eclipse 
personnel informed FAA engineers that they would need to do research and development for 
aircraft flight testing in only 7days then present the aircraft immediately to the FAA for type 
inspection authorization (TIA) certification flight testing. 

The Eclipse DERs were being pushed to meet the company perceived minimum of the regulatory 
requirements and to further minimize testing in order to meet these requirements. For example, 
during a three-month stretch, the Company DERs were continually trying to tell the FAA 
engineers what the intent of complying with fuel systems regulations were despite the fact that 
the FAA engineers were clear in what the regulations required. 

In 2003, the Eclipse project was transferred fi-om Chicago ACO to the southwest based ASW- 
1 50/Airplane Certification Office (based in Fort Worth, Texas, referred to as “ASW”). The 
Chicago team had about 9 employees while the ASW-150 had about eight employees with the 
assistance of five more from other certification offices. 
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FAA’s Imposed Pay for Performance Plan 

On July 10, 2005, the FAA unilaterally imposed a new pay system and work rules on multiple 
NATCA bargaining units including the Aircraft Certification. The new, non-negotiated pay 
system is called Core Compensation. One aspect of this pay system is that it replaces annual step 
increases with Superior Contribution Increases (SCI). These SCI increases are awarded to some 
individuals based on a management only assessment of their performance for the fiscal year. 

This is problematic on a number of levels. First, it creates a competitive work environment since 
there are only a fixed number of SCI increases which is not conducive to the type of teamwork 
required for such high level engineering projects. Second, managers are not required to clearly 
justify why a particular employee was chosen or denied an SCI. This allows managers to use 
subjective or in some cases inappropriate criteria for rewards or punishment. In the case of 
Eclipse, FAA managers were able to retaliate against an employee who refused to buckle under 
management pressure to change their technical positions. Third, it is our understanding that top 
FAA management pay is tied to the accomplishment of goals within the FAA business plan, 
which contains a number of non-safety items. For example, the FY 2006 business plan 
contained the goal of certifying a Very Light Jet by the end of the Fiscal Year. As pay was tied 
to the accomplishment of this goal, FAA engineers in the Eclipse project came under significant 
pressure to certify Eclipse within this time frame, despite outstanding safety concerns and the 
lack of demonstrated compliance to the safety regulations. 

FAA-Private Sector Cross Pollination 

In the fall of 2001, it was announced that the former FAA project officer overseeing Eclipse 
project, Mr. Randy Griffith, had left the FAA and was now the Eclipse Aviation Airworthiness 
Coordinator. Mr. Griffith thus became the principal point of contact to the FAA on behalf of 
Eclipse. This appears to be in violation of FAA ethics standards. According to the FAA ethics 
training manual for 2006 a former agency employee who accepts a job may “have some 
limitations in communicating with his former agency on his company’s behalf’ and one cannot, 
for a period of two years, represent his or her new employer before their former agency.”^ 

Pressures on Project Officers 

Project Officers (members of the NATCA Aircraft Certification bargaining unit) also found 
themselves under tremendous pressure regarding the Eclipse certification project. One example 
of this occurred during a technical meeting with Eclipse, the project officer, and the Chicago 
ACO. The meeting began with the project officer taking a firm position in regards to function 
and reliability testing policy. During a break, the project officer was informed that the lead 
manager of the Small Airplane Directorate (SAD) was on the phone, so he was brought into a 
private Eclipse office to take the call. After the break was over, the project officer returned to 
the meeting and chose to back off his technical position. The project officer later told a Chicago 
ACO engineer that during the telecom, the lead manager from SAD ordered him to back off his 
technical position in regards to function and reliability. 


^ Federal Aviation Administration Annual Ethics Training 2006 “A Brief Wrap on Ethics” pg 36 
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Additionally, project officers were forced to do their jobs without proper support and without 
open communication with front-line ACO engineers. One project officer was forced to juggle 
several projects in addition to Eclipse, and asked for assistance so that the Eclipse program could 
receive the attention it required. This officer was also tasked with coordinating the logistics of 
an Equivalent Level of Safety (ELOS) document for the Airspeed Indicating System in the 
Eclipse 500 Jet. An ELOS is written when, due to the unique design of a part or system in an 
aircraft, it is unable to comply with the letter of the safety standard but is able to comply with the 
intent of the standard. This project officer was not informed by FAA management of the 
technical opposition of the ELOS by the ACO engineers, and thus was tricked into helping create 
the ELOS despite outstanding safety concerns. This FAA management interference occurred 
many times in the Eclipse project. At the end of September of 2006, the project officer was told 
by his managers that “Eclipse had met their compliance goals”, but was not made aware of the 
still open technical objections by ACO engineers. 

Lack of direct communication with the ACO engineers coupled with the high level of FAA 
management involvement compromises the project’s safety objectives. The standards 
themselves became muddled, while management coercion and lack of communication with 
engineers made it nearly impossible to determine if standards were being met. 

Pre-Type Certificate Concerns with Eclipse - Fort Worth Aircraft Certification Office 

After the project was moved to ASW- 1 50 in Fort Worth, Texas, I started to receive many verbal 
complaints and concerns from employees. In the initial PSP, it was stipulated that after the 
project’s transfer to the southwest region, the PSP would be reviewed and renegotiated. 
Unfortunately, after said transfer, complaints were made to me that the hands of the engineers in 
Fort Worth were tied due to the initial PSP and other earlier documents that prevented these 
engineers from formally bringing up new safety concerns. In one case, an engineer was opposed 
to an ELOS which was written to address how the airspeed indicating system and pitot static 
system were created, but his concerns regarding the ELOS and the performance of the Eclipse 
500 Jet were dismissed by FAA management. Several months after the aircraft was approved, 
the FAA would have to reverse itself and write an airworthiness directive (AD or safety law) due 
to three incidents where the pitot static system failed due to freezing condensation - exactly what 
the engineer and the regulations said needed to be addressed. This AD also limited the aircraft to 
daytime flying and mandated the use of two pilots. 

Because the design of Very Light Jets (VLJs) differed so significantly from conventional jets. 
Federal Aviation Regulation number 23 proved ill adapted for Eclipse certification. It was 
brought up to me, well after the filing of the grievance, that the Small Airplane Directorate 
(SAD) had issued an “unofficial Part 23 Jet Certification Guide” to address the application of 
new safety conditions to various classes of light jets. It is my understanding that the document 
was not applied in total to the Eclipse 500 Jet due to the objections of the Eclipse company and 
due to the PSP/PSCP goals and procedural limitations. 
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Provisional Type Certificate and Verbal Harassment 

On July 27, 2006 , the FAA held a large press event at the Experimental Aircraft Association 
(EAA) air show in Oshkosh, WI to announce the preliminary TC approval for the Eclipse 500 
Jet. According to an FAA press release there were “no major problems” complicating a future 
issuance of the final TC, Yet problems persisted and the engineers continued to express their 
technical objections that the aircraft was not meeting the safety regulations. The FAA ignored 
these protests and issued the preliminary TC in spite of these issues. 

A few weeks after the provisional TC press event, a meeting was held at the Eclipse headquarters 
in Albuquerque, NM. According to reports from engineers present at that meeting, Mr. John 
Hickey/AIR-1, and other top level FAA DC managers were present at the meeting, although 
managers from the small airplane directorate were conspicuously absent. During the meeting, 
Mr. Hickey told the group “we are here to save this company [Eclipse]”. One engineer 
responded that his job was to make sure the aircraft complied with the safety regulations, and he 
was subsequently rebuked by Mr. Hickey in front of the other employees. Mr. Hickey then 
proceeded to intimidate and verbally attack each individual on the team. When I sought to 
address this harassment by calling Mr. Hickey in my capacity as the NATCA Representative, I 
was directed instead to his assistant manager, Dorenda Baker/AIR-2, who dismissed my 
concerns by saying that the engineers “misunderstood” Mr. Hickey and that he was only 
encouraging them to think outside the box. 

Final Type Certificate - Outstanding Concerns 

During September of 2006, 1 was informed by bargaining unit engineers that the Eclipse 
Avidyne electronics suite was still not functioning safely, had not complied with the TSO 
requirements, and needed further research and development. At times, one of the two screens the 
pilots were using would blank out for fifteen-second intervals and thus deprive the pilot of 
critical information. The first attempt to fix the problem was unsuccessful; rather than 
preventing the screens from turning blank, the changes prevented the blank screen from returning 
to functionality. Because of this safety concern, the engineer did not approve the related FAA 
document, citing that the electronics suite did not comply with regulations. Just as with the pitot 
static system, this engineer’s technical assessment was proven accurate. In February of 2007, 
Eclipse announced that they were no longer going to use the Avidyne suite due to its lack of 
reliability and functionality and would be retrofitting aircraft with the Avio NG. In an informal 
conversation with Avidyne, I was told that with more time and testing Avidyne would have been 
happy to address what they acknowledged were legitimate pre-type certification safety matters. 

Nothing would deter the FAA from their certification goal, not even ongoing tests. I was 
informed that while FAA flight test pilots were in the air conducting flight tests, a group of FAA 
managers had met and determined that the Eclipse aircraft had met their compliance goals. The 
FAA flight engineers and flight test pilots were shocked to say the least. 

Well after the filing of the grievance, a copy of the FAA’s final type certification board meeting 
minutes was provided to me for review. That meeting was held in late July of 2006 and 
highlighted four and a half pages of outstanding safety concerns and incomplete tests - some of 
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which I have outlined above. Despite these outstanding concerns, there was no discussion of 
moving the type certification goal past the end of September of 2006 and into the next fiscal 
year. 

On September 29, 2006, 1 spoke with one of the engineers and was told that they were not going 
to sign off and approve the TC for the Eclipse aircraft. I reaffirmed to the engineers that 
NATCA was behind them 100% and appreciated the good safety work they had accomplished. 
These engineers did not sign off on the TC approval. 

According to my understanding, the next day, September 30, 2006, FAA management ordered 
the Eclipse project manager to come into work on a Saturday and convinced her to sign off on an 
Eclipse document approving of all engineering and flight test aspects of the Eclipse 500 Jet. The 
final TC was then signed by the Ft. Worth AWS-150 Manager, Michele Owsley. The Eclipse 
TC document allows the aircraft to fly with almost no limitations, despite the clearly stated non- 
compliance of its software systems. The FAA type certificate data sheet (TCDS) fails to 
establish any significant limitations or restrictions or identify any mitigation document created 
especially for Eclipse by FAA management. Such limitations are standard procedure when 
outstanding concerns persist. 

The FAA management issuance of a TC without allowing the aircraft certification engineers and 
flight test pilots to properly complete their assigned certification/safety responsibilities is in 
direct violations of laws, regulations, and policies. The issuance of a TC without concurrence of 
all FAA engineering and flight test personnel is a significant change in proper FAA engineering 
procedures. In addition, this behavior contributed to significant adverse affect to the morale and 
performance of the engineering workforce as it degraded their professionalism by ignoring their 
technical decisions and dismissing the value of comprehensive testing. 

NATCA Files a Grievance 

On October 20, 2006, after discussions with some of the FAA engineers that worked on the 
Eclipse program and local NATCA representatives, NATCA decided to file a grievance against 
the FAA. The grievance seeks to obtain proper legal protection and representation of the 
employees that were involved in the project and allow the employees the option to not work any 
further on the Eclipse project. In addition, the grievance seeks to remedy damages caused by the 
FAA’s flawed pay for performance plan by prohibiting the FAA from penalizing any employee 
for expressing or noting safety issues during the Eclipse aircraft program. It was a concern of the 
Union that the imposed pay rules would allow managers to reprimand, issue negative 
performance evaluations or ratings, or deny employees any or the maximum performance pay 
increases (known as SCI ratings). Since the filing of the grievance, the Union has been 
approached by two employees that were given less than the maximum SCI rating due to their 
technical positions in the Eclipse program. 

The FAA has never formally responded to the grievance although the grievance described a 
remedy wherein the Union and the agency could meet to bargain to restore the professionalism 
that is essential in the agency’s safety mission. With FAA management continuing to overturn 
engineer’s safety decisions and the diminishing trust between the FAA and the engineers. 
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NATCA has stepped in to file more grievances and technical safety letters and comments on 
behalf of its bargaining unit employees. NATCA bargaining unit employees have also submitted 
evidence to Congress of further examples of FAA management maintaining dangerously close 
relationships with the industry, as this problem is not limited to the FAA’s relationship to the 
Eclipse Corporation. 

Post Type Certificate Review 

Many problems and near accidents have occurred with the Eclipse 500 Jet since the issuance of 
its final TC. A November 16, 2006, Avweb Flash article reports Eclipse grounding its Eclipse 
500 Test Fleet. A memo from Eclipse to its customers states that the company chose to ground 
the Eclipse fleet for two weeks because of problems with the aft wing attachment bolt bushing. 
According to Eclipse, the aft wing attach was designed to prevent forward and aft wing flexing 
during hard landings. However, in the memo, the company expressed concerns over the potential 
for wing separation or failure on the Eclipse 500 Jet. The Eclipse memo also announced 
windscreen cracking problems in the patch holes where the windscreen attaches to the airframe. 
Cracks are reported on the outer layer, but loss of pressurization is a concern. The cracking is 
reported as a structural fatigue issue, which is unusual for an aircraft that is still so new, and 
Eclipse is requiring a 100 cycle visual inspection. In light of this, no action was taken by the 
FAA. 

On March 2, 2007, an Eclipse advisory letter announced eight major safety and production in the 
areas of functional test procedures (FTP), manufacturing workforce, and production rate.^ 
According to the article, the bolt bushing problem has been corrected, but Eclipse is still 
experiencing supplier delays and quality problems, FTPs are being rewritten because of accuracy 
issues, safety-critical friction stir has required special engineering analysis, and DER approval, 
and “some components” are experiencing higher failure rates than anticipated. Still no action 
was taken by the FAA. 

In early June of 2008, an Eclipse 500 aircraft nearly has an accident at Midway airport in 
Chicago, IL. The aircraft almost crashes due to the failure of the highly integrated engine 
software and electronics system, which allow the pilot to control engines properly during 
landing. It came to NATCA’s attention that an FAA chief scientific and technical advisor was 
rebuked for investigating this matter and for reporting his findings that the Eclipse software 
system was non-compliant to the regulations. 

As recently as August of 2008 another engine software incident occurred. An Eclipse 500 Jet 
attempting to land in Pennsylvania drove off the end of the runway. It was reported that the 
engines were, again, unable to be shut down. No casualties were reported, but a small child may 
have been injured. 

As of September of 2008, the European Aviation Safety Agency (EASA), the European 
equivalent of the FAA, has not yet certified the Eclipse 500 Jet. One outstanding technical 
concern is the 30 minutes of reserve eleetrical/battery power after loss of engine power, which 


’ Aero-News.net article “Eclipse 500 Production Schedule Slips Due To Several Issues” http://aero- 
news.net/news/conmibus.cfin?ContenlBlocklD=50a01fc0-d407-4fa4-978a-52f735ed2b9c&Dynamic=l 
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had been approved by the FAA management. Like FAA engineers and the ehief seientific and 
technieal advisor (CSTA), EASA believes that the aircraft should have 60 minutes of reserve 
electricai^atte^y power. However FAA management overruled these technical findings during 
the US certification process. 

In anticipation of this hearing, the FAA has begun and concluded a special certification review 
(SCR) of the Eclipse program and a service difficulty review report. In both cases, FAA 
engineers with the technical expertise on light jets have not been included in the final assessment 
of the data developed. The SCR team of alleged specialists is being asked to determine if any 
pre-TC safety issues have manifested as service difficulties since the aircraft entered the market. 
This team, led by a former Boeing employee, is composed of managers outside of the Small 
Aircraft Directorate and all but one of who reportedly have no experience with small jets 
certification. This team does not appear to comply with the intent of the FAA’s SCR policy. 

Conclusion and Recommendations 

The FAA’s behavior during the certification of the Eclipse 500 Jet was inexcusable. They 
intimidated and coerced federal employees into ignoring safety regulations. Our safety system 
works because of the laws and regulations that exist to protect the flying public, but it will only 
continue to function if those laws and regulations are followed. The FAA must have a zero- 
tolerance policy with individuals that encourage non-compliance and thus put the flying public at 
risk. Therefore, I would like to offer the following recommendations: 

1 . The FAA’s business plan needs to be refocused on safety-only mission related goals. 
Mandating a specific timeframe for certification of an aircraft creates unnecessary 
pressure for speedy certification and compromises the safety and integrity of the aircraft. 

2. Title 49 must be amended to allow the Union to negotiate fair and professional pay 
procedures that encourage and reward compliance to the safety mission of the agency. 

3. Delegation must be restricted to individuals who are reviewed and approved directly by 
the FAA, not using a private company as a surrogate. Allowing a company to select the 
individuals who determine compliance creates a conflict of interest. 

I would like to thank these engineers and flight test pilots who did their job by raising the 
questionable management tactics to the Union. I would also like to commend this committee and 
the Inspector General for investigating the questionable management tactics and allowing the 
truth to be presented in an open public forum. 
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Written Submission. David Downey September 17, 2008 
C(»nmittee on Transportation and Infrastructure. Subcommittee on Aviation 

The FAA’s Rotorcraft Directorate, has conducted itself in an ethical, 
honorable and professional manner in the matter regarding the Eclipse 
Aviation Corporation (EAC) Eclipse 500 jet. The employees involved in the 
Eclipse 500 certification as well as their fellow FAA employees from around 
the country are the finest employees I have had the privilege to serve with. 
There have been characterizations regarding professional competence and 
conduct that are unfair and unmerited. 

As the Manager of the Rotorcraft Directorate, I was ultimately responsible 
for the engineering compliance oversight of the Eclipse 500, lead by Ms. 
Owsley. Likewise my role was similar in the oversight of the 
production/manufacturing aspects of the Eclipse 500. 

The Eclipse jet is a novel jet in this day. However, the company is still 
required to demonstrate compliance to the Federal Aviation Administration 
rules regarding both design and production. 

The events, which I will describe, regard a Department of Transportation 
Inspector General investigation into the inappropriate influence by FAA 
officials in both the EAC 500 Type Certification and Production 
Certification programs. 

In August 2006, 1 was directed by the Director, Aircraft Certification Service 
to personally become involved in the Type Certification program of the EAC 
500. This can differentiated from the 250 other programs within the 
Rotorcraft Directorate and my earlier position in the Engines and Propellers 
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Written Submission, David Downey September 17, 2008 
Committee (wi Tf^sportation and Infrastructure, Subcomnuttee on Aviation 

Directorate, where I rarely had this type of either direction or Washington 
involvement. 

The events leading to EAC 500 problems are numerous and somewhat 
complicated. I will as best I can simplify this portrayal. EAC was a brand 
new company that was trying to make a big splash in the aviation industry. 
Articles in various trade publications and interviews the Chief Executive 
Officer, Vem Raeburn created a very public and well documented awareness 
of the EAC 500.'’^ Vem was even a keynote speaker at the Aircraft 
Certification Services’ all-mangers meeting. However, they were befallen 
by an engine design issue that could only be solved by a completely new 
manufacturer. Imagine if you will, you have placed an order for a new 2009 
automobile only to find that the promised power plant must be changed and 
you will have to wait - and the company still holds your financial deposit. 

This was a company that aspired to go from a production rate of zero to 150 
in the first year (2006) and 600 their second year (2007)— Unheard of in the 
aviation industry and unrealistic. Further, this was a company that wanted to 
gain its engineering approval - aka TC, its production approval or PC, its 
Repair Station Certificate and have aircraft awarded their Standard 
Airworthiness Certification all within 15 days. That would similar to a 
student going to college for 4 years and expecting to get two BS’s and a 
Master’s all the same day — Possible - but highly unlikely. No amount of 
FAA “coaching” would dissuade EAC executives and staff that this feat was 
not practical and overly ambitious. This did not stop the public 
proclamation of 31 March 2006 Type Certification date by EAC in both 
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Business and Commercial Aviation and AOPA Pilot magazines. During a 
July 2006 visit to EAC the FAA Administrator was briefed on the March 
2006 TC date by Vem Raeburn; this created an additional “atmosphere” of 
expectation^. Mr. Raeburn’s casual mention of several high ranking state 
and federal officials only raised our awareness of the political clout that 
could be brought to bear. 

EAC had over the previous years, established a legacy of not meeting its 
commitments to the FAA. EAC rarely submitted a report on time, yet had 
the gall to drop a report on the FAA and want approval immediately. It was 
not uncommon for other FAA offices to tell the Ft. Worth Airplane 
Certification Office that they would not be able to forward an approval till a 
date that was well beyond what EAC was telling the Ft. Worth FAA offices. 
As a test pilot, I was also very concerned at the turnover in the test pilot 
community. During this program the FAA dealt with at least four different 
“chiefs” of flight test or similar titled persons. This certainly created an air 
of concern on the part of the FAA. As one company test pilot shared with 
me, his integrity test light had been pushed way too many times. Each 
event in and of itself would not necessarily be concerning, however when 
you couple all this together - the pattern of misinformation, missed dates 
and a willingness to go straight to Washington DC left the field FAA 
personnel in a very untenable situation. 

When it became apparent that EAC would not receive their TC by Oshkosh 
2006 (EAA AirVenture) they requested they be granted a Provisional TC - 
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this caused the FAA to stop all work on the TC effort and focus resources on 
meeting this request. 

On 14 Sept 2006, a late afternoon meeting was convened with the FAA 
employees involved with the EAC 500 in an Albuquerque hotel.'' In 
attendance were the pilots, inspectors, engineers and four FAA Executives 
among the Executives was the Director, Aircraft Certification Service. It 
was completely clear to all FAA employees present that the current approach 
to the software certification on the EAC 500 was not going to meet the EAC 
500 calendar schedule or the Service Director’s timetables. As an aside, 
during my Software class at the Defense Systems Program Management 
course we were taught that software should be event driven not calendar 
driven. And, any software program with a calendar schedule - run the other 
way. The field FAA experts were justifiably unconvinced of EAC’ s ability 
to perform. 

In this 14 September meeting, the FAA Software Engineer, Mr. Wallace 
tried to convey to the Service Director that the EAC approach would not 
follow the established FAA procedures and was sorely lacking in meeting 
the Agency’s established and time-tested software certification procedures 
not to mention EAC and their vendor never meeting a calendar date for a 
data submission. Mr. Wallace was summarily subjected to a verbal barrage 
that conveyed that he, Mr. Wallace was not able to think “outside the box”. 

It was at this point that I interjected myself between my staff employee and 
the Service Director. My “taking up” for him resulted in my dressing down 
and a humiliating verbal assault in front of my subordinates and peers. In 35 
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years of public service as an Army officer and FAA emplbyee I have never 
suffered an experience as denigrating or unwarranted. It was clear to those 
present that Mr. Hickey was passionately making the case for thinking 
outside the box, however, the box must still be within the bounds of 
regulatory compliance and appropriate risk management. I have heard this 
Albuquerque meeting characterized as Mr. Hickey’s passion for meeting 
customer needs and thinking outside the box - 1 would characterize it as an 
assault on our professionalism and our character. 

Every FAA employee left that meeting with a clear picture that it was our 
responsibility, the FAA and not Eclipse to find a solution to the software 
issue. One was found. EAC and the avionics manufacturer would make 
attestations to the FAA that the software architecture had no “unsafe feature” 
and did “its intended function.” A question that is fair to ask: Is it safe? 

The answer was yes. There was no incident that was not managed and/or 
mitigated by the cockpit procedures or the fact the aircraft could only fly in 
daylight and clear of clouds and no aircraft would be delivered to customers. 
The FARs only requires a minimum level of safety - EAC met this burden. 
By analogy, it would similar to the new car that can only be driven on dry 
country roads, no interstates, in day light conditions and you have to have a 
driving instructor with you. 

The following week, the final Type Certification Board was held. The FAA 
agreed to numerous lOUs fi-om EAC - this is not uncommon but the FAA 
personnel were under a great deal of pressure to meet the EAC target date of 
30 September 2006.^ What many of us were unaware of was the contractual 
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obligations to creditors that EAC had agreed to. Among these was that 
financial backing was contingent on gaining the FAA airplane Type 
Certificate within 30 days of Pratt & Whitney getting their FAA TC for the 
engine. Also, there were stock options/employee benefits tied to meeting 
dates. These items did not come to light until very late in the program and 
were extremely unsettling to many FAA employees not to mention the 
morale factor. 

In the spirit of full disclosure - during my tenure we did help other 
companies in a comparable manner - our approach was “no harm no foul.” 

If all the Federal Air Regulation compliance findings were made and all the 
Agency was waiting on was a formal report submission, and being legalistic 
about the submission would cost the company millions of dollars and the 
very livelihood of the employees ~ we would accommodate the applicant. 

There were other issues that were “floating” around this effort that FAA 
personnel were aware of The FAA became privy to a mis-sent email 
detailing an EAC strategy to use the Service Director’s influence in the 
software certification issue.^ It would be fair to note that no evidence exists 
that the email was ever sent to Washington. However, it served notice to the 
FAA project employees that no Eclipse tactic was “out of bounds.” Further, 
it became clear that EAC was prepared to go to the mat regarding the DO- 
178B software compliance. Their mantra was that DO-178B was not 
binding in a regulatory sense.’ This was correct - however, at this point in 
time, there was no other means of software compliance that the FAA had 
agreed to. If the FAA were to have agreed up front to the EAC approach, 
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this method of compliance would have been properly staffed via an Issue 
Paper through the appropriate policy offices in the very beginning of the 
program. The FAA project team was trapped between Eclipse and the 
Service Director and we knew it. There was no chance that an Issue Paper 
would have been considered at this 77'* hour considering the pressures and 
“influence” faced by ACO personnel. 

The EAC lOU for the avionics software was 1 5 Oct 2006. * The TSO 
approval for the avionics was finally granted on 23 March 2007 - some six 
months later.® 

The production and manufacturing program suffer some of the same ills as 
the Type Certification program. In many respects, production is harder than 
the engineering. Engineering can change a design in a computer and 
generate a report - production involves suppliers, tooling, bricks and mortar, 
purchasing systems, storage, trained personnel, parts qualification, 
documentation and a quality system that will insure that each and every 
aircraft conforms to the Type Design data and is in condition for safe 
operation. 

The FAA-mandated quality system is extremely thorough. The FAA system 
has insured that aircraft manufactured regardless of the size of the company 
are airworthy. The production and manufacturing issues at EAC were 
typical of a new company. EAC was trying to do too much with inadequate 
processes, controls and trained personnel. 
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From the time that EAC received their Type Certificate their focus became 
their Production Certificate. However, prior to the awarding of the TC, FAA 
inspectors had been doing ongoing inspection of Eclipse’s quality system. 

In fact, FAA Inspectors completed a District Office audit prior to the award 
of the TC that documented numerous non-compliances. 

The basic state of affairs post-TC was that Eclipse was not qualified to 
receive a Production Certificate. There were numerous issues. In order for 
an aircraft to be prepared for customer delivery and award of an FAA 
Standard Airworthiness Certificate, there are a series of Functional Test 
Procedures, 36 if I recall correctly that must be successfully completed. The 
Aviation Safety Inspectors from the Directorate spent an extraordinary 
number of hours editing and auditing these proposed procedures. There 
were numerous accounts of procedures being incomplete, the procedures not 
accurately or thoroughly evaluating the system and special tools not being 
called out in the procedure. There were numerous documented examples of 
EAC personnel signing off Functional Test Procedures as complete, in other 
words the aircraft systems passed. When FAA personnel followed up, the 
systems failed to pass the procedures. This further exasperated the 
situation. EAC was very vocal about the FAA being overly detailed. The 
FAA role is to oversight the FAA designees. It was established that EAC 
management was working around the EAC Organizational Designated 
Airworthiness Representatives or ODAR. By example, an aircraft was 
closed up - that is floors installed prior to the ODAR inspecting the aircraft. 
When the Eclipse ODAR queried if the inspection of under-floor fuel lines, 
control cables, electrical cables and clamping still must accomplished? The 
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FAA responded - yes. This meant that the interior floor had to be removed 
to allow the required inspection. The FAA employees were “blamed” for 
this mismanagement of the workflow. 

The quality system at Eclipse was in disarray. The personnel turnover, lack 
of personnel, pressures to have airplanes ready to sell post-TC award kept 
the company in a state of constant change. It was apparent to FAA 
personnel that ODAR personnel, persons acting on behalf of the FAA were 
being harassed and hassled for trying to meet the FAA standards. 

In early March 2007, 1 received a phone call from the Director and Deputy 
Director of the Aircraft Certification Service regarding the documentation 
requested by the FAA to support the issuance of Airworthiness Certificates 
for the EAC 500 aircraft. The Eclipse CEO, Vem Raeburn had called the 
Service Director to complain that the FAA was making unreasonable records 
requests. An email from Mr. Lauer, San Antonio MIDO Manager to EAC, 
Mr. Dwight Byars had been sent to appraise EAC of FAA expectations. 

From that phone call and I paraphrase: “Vem wanted to know why does the 
FAA want the @#$% @#$% sealant records?” At the time, I did not know 
the answer and I informed the Service Director that I would find out. It was 
on this same telecom that I was informed that Mr. Ron Wojnar would 
assume oversight of the production/manufacturing issue with Eclipse and I 
was relived of those duties. Back to sealant records - After consulting with 
the experts on this I discovered the sealant records have to be examined to 
insure that the shelf life has not been exceeded. Ordinarily, the shelf life of 
sealants would be insured by the Production Certificate quality control 
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system - a system that Eclipse was unable to demonstrate. It is appropriate 
to point out this phone call event was in reference to aircraft Serial Number 
3. This aircraft had previously been rejected for its airworthiness certificate 
and this records review was required for the FAA re-inspection. The 
manufacturing office manager, Mr. Lauer in his email to EAC was putting 
into writing the records for review in conjunction with the physical 
inspection of the aircraft that are required by FAA Order 8130.2F and 14 
CFR part 21 . The Eclipse furnished records for Serial Number 3 showed 
393 deviations from the type design. Although many of these were small or 
minor deviations, this was a properly conducted review. 

Regarding my being “relived”, at this point I felt it would only validate what 
we were doing and have “Washington” come in and experience first-hand 
what had been going on with the FAA’s efforts with Eclipse. We had been 
following FAA Orders so: What was the dovmside to a third party looking 
into the issue? I was sorely naive and the result highlighted an ethical 
climate that was unsettling. 

There is an EAC Production Certification Report generated by Mr. Wojnar 
to the Ms. Baker, the Deputy Service Director.'' It contains data that 
portrays a story that is accurate in some regards but also has a slant and 
factual inaccuracies that would make the Aviation Safety Inspectors from 
the Rotorcraft Directorate look overbearing and zealous. It also contains 
misleading statements regarding myself and the Rotorcraft Directorate staff. 

It should be noted that verbal reports from Mr. Wojnar to me on 6 March 
2007 (and I have the notes) and my staff did not reflect the same content as 
the written report.'^ This report was only recently made available to 
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Rotorcraft Directorate personnel after the notice of this Subcommittee 
Hearing. I requested this report from Ms. Baker back in the summer of 2007 
and she denied that request. 

The FAA Manufacturing Inspection District Offices will normally conduct 
District Office audits to ascertain the readiness of an applicant for a PC 
inspection. The first of three FAA District Office audits showed that Eclipse 
had numerous areas that needed improvement. The subsequent audits had 
numerous write ups. The last of the three audits, out-briefed on 16 Feb 2007, 
documented 70 non-compliances. At the completion of the out-brief with 
Eclipse management, the Chief Operating Officer was informed by myself 
that a lot work was required. I had further conversation with the COO the 
following morning. We estimated it would take 3-6 months for Eclipse to 
make the necessary corrective actions. It was three months to the day when 
Eclipse was awarded their Production Certificate. 

These issues detailed are but a few of the issues the FAA employees dealt 
with. The bigger cultural issue was the demonstrated lack of confidence in 
the field FAA employees by Mr. Hickey and others. This coupled with the 
access Eclipse had to senior leadership and the inability to have a balanced 
story portrayed was a gross injustice. The FAA inspectors, engineers, and 
pilots deserved better. It goes without saying you will hear a different story 
from your subsequent panel. In fact, I expect to be maligned, disparaged 
and at best displayed as incompetent - 1 will let the record speak for itself. 
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I will survive this event. The bigger concern is the tarnished reputation of 
the FAA employees involved particularly the ones who tried to raise 
concerns. It was my duty as the leader of the Rotorcraft Directorate to 
insulate the staff from the “unfairness”. The FAA team “felt” undermined 
and threatened by having their decisions questioned from Washington. This 
poisoned the atmosphere and morale was terrible. There are 250 other 
companies the Rotorcraft Directorate oversees — no other similar set of 
circumstance comes close to this situation. In fact, the final Quality 
Management Review conducted prior to my resignation, as I recall had over 
30 Positive comments from customers. 

Integrity is something I learned at the feet of my father - a 28-year career 
Army officer. I was an Eagle Scout and served over 20 years in the Army as 
an enlisted soldier, a Warrant Officer and Commissioned Officer, I have 
three brothers that are officers in the Armed Forces. One brother is a serving 
Inspector General. My son is in the Army as well. Integrity is at the root of 
our desire to be public servants. 

When leadership gives more standing to the applicants than the FAA 
professionals, especially given the track record that was well-known, it 
undermines the role of the FAA in performing its government oversight 
function. I have made mistakes in my career - but the handling of the EAC 
500 program is not one of them. 

My decision to leave the FAA was reached over a year ago and was not the 
EAC 500 program. It was clear to me that my value system and leadership 
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style were in conflict with senior leadership. It was time to close that 
chapter and move on. 


* Business & Commercial Aviation EAC Ju! 05 
^ AOPA-Pilot EAC Article Jul 05 

’ PowerPoint Briefing, EAC CEO to FAA Administrator, 1 1 June 2005 

■' Email, Michele Owsley to FAA personnel, subject: FAA only meeting Albuquerque, NM. 9/13/06 

’ Final Type Board PowerPoint presentations from EAC, (Avionics-Electrical, Mechanical systems, 
Interiors-Flammability, Power plant and fuel systems. 2 1 September 2006. 

^ Email, Ken Harness to EAC Executive Management, subject: EFID TC plan 8-3 1 -06,doc, date: 3 1 
August 2006 

’’ Letter, EAC to FAA, subject: Response to FAA Ft worth ACO Letter, date 8 September 2006 
® Personal notes, EAC meeting with David Downey 1 September 2006 

’ Letter, FAA, Boston ACO to Avidyne Corporation, subject: TSO Authorization, C2d, C3d, ClOb, C43e, 
C44b, C47, C49b. C55, C95. C 1 1 3, and Cl 39 for AVIO Multifunction Display. 23 March 2007, 

“ Email. From Mr, Lauer, FAA to Mr. Byars, EAC, subject: Airworthiness Inspection, P-2 & P-3, dated: 
2/26/07. 

* ' Report, Mr. Wojnar to Ms. Baker, FAA Report, ECLIPSE AVIATION CORPORATION, Production 
Certification 

12 

Notes, Telcon with R Wojnar and David Downey, 6 Mar 06 
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Federal Aviation 
Administration 


Memorandum 


Date: August 2, 2007 

To; Dave Downey, Manager, Rotorcraft Directorate 

From: Dorenda D. Baker, Deputy Director Aircraft Certification Service 

Subject: Mid-Yoar Performance Discussion Follow-Up 


This serves as a follow-up to mid-year performance discussion regarding your performance, 
specifically regarding your management of the Eclipse certification program. Our discussion of 
your performance addressed the following: 

Perfermimce Expectation, Item 3 - Demonstrate application of the leadership dimensions 
ftiat comprise the Executive Success Profile; (a) Achieving Operational Results, (b) Leading 
People, (c) Building Relationships, (d) Leading Strategic Change. 

During the initial discussion of your fiscal year 2007 Executive Perfomance Management Plwi, 
on October 31, 2006, John Hickey AIR- 1 explained and reiterated his expectation that 
Executives personally engage with their staff to understand issues and to help resolve conflicts 
with industry. This expectation is directly aligned with the performance expectation in your 
Executive Performance Management Plan to demonstrate application of leadership dimensions. 

The need to reiterate the expectation of executive personal engagement came as a result of 
foilur^ that occurred in the Eclipse Type Certification (TC) program. After receiving a number 
of indicators that the program was in disarray, John Hickey personally traveled to Albuquerque 
to investigate the reports. He found that the certification team was imposing requirements on 
Eclipse that were not based in the regulations and that the staff didn’t seem to understand that 
under §21.21 the applicant is entitled to a type certificate if the design meets the applicable 
airworthiness requirements and has no unsafe feature. When Eclipse requested a Provisional 
Type Certificate the staff didn't appear to understand part 21 Subpart C-Provisional Type 
Certificates. Again the applicant has an entitlement under §21 .8 1 , During his visit, John Hickey 
expressed his expectation that you, as an AIR Executive, are responsible for coaching your 
employees. You are expected to personally engage with your staff and customer and to assure 
proper application of the regulations. 

Following his visit John Hickey had to intervene on a number of occasions to assure that the 
certification team was following FAA regulations, Orders and policy. This is unacceptable. As 
an Executive you should have demonstrated the leadership dimensions of 1) building 
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relationships by personally working with Eclipse to fully understand the issues that they were 
facing, 2) leading the certification team in assuring proper adherence to our Orders and 
application of the regulations and 3) achieving operational results by developing a mutually 
agreed plan to achieve certification of the Eclipse 500. We understand that you had a number of 
meetings/telephone calls with executives at Eclipse however; the results did not indicate that you 
fully understood the complexity of the issue and the working relationship of the FAA 
certification team with Eclipse. Had you been personally engaged in developing a solution to the 
problems and counseling the certification team it would not have developed into an issue that 
required intervention by AIR-1 . 

Four months after John Hickey reminded you of his expectation that you personally engage in 
conflicts between your staff and our customer, he received a call from the President of Eclipse 
complaining that the FAA was again imposing requirements that went beyond the part 21 
regulations. Prior to the call, ArR-l/'-2 received a number of eimails and Dashboard updates 
from you describing the problems that the Eclipse company was having in their pureuit of a 
Production Certificate (PC). As a result of your input, we believed that you were personally 
involved m assuring that the Rotorcraft Directorate employees were following the regulations 
and Orders. You led us to believe that the delays and problems were exclusively due to Eclipse 
not understanding their responsibility to oversee production and develop a reliable quality 
control program. After listening to the complaints from Eclipse management John Hickey 
discussed the company’s concerns with you. He found that you failed to personally engage with 
your staff and the company. As a result he removed you from oversight of the Production 
Cctlificate activity and a new leader, Ron Wojnar, was sent to investigate the allegations and get 
the program hack on track. You welcomed the opportunity to have an impartial party review the 
problems stating that you felt that he would find that everything had been handled properly. 

On March d"", Ron Wojnar, met with Jerry Strentz, ASW-180, to understand FAA’s position on 
the issues at Eclipse. Ron Wojnar called upon expertise from the Transport Airplane Directorate 
and the Engine and Propeller Directorate to assist him. March 13-16 the team met with Eclipse 
to hear their side of the story. 

Ron Wojnar discovered that the FAA team was not following Order 8120.2D (8/17/2004), Page 
12. The Order is as follows: 

. .PART 2. FAA ACTIONS DURING THE SIX-MONTH PERIOD 

"24. FAA CONFORMITY DETERMINATIONS. Subsequent to the date of issuance of the TC 
and prior to the issuance of an APIS or PC, the MIDO/CMO has fljll re^onsibility for 
determining whether the product or p3rt(s) thereof conform to the type desipi and are in a 
condition for safe operation. The MIDO/CMO has the responsibility for perfonning inspections 
of incoming materials (at the source, if necessary), installations, and the completed products. The 
MIDO/CMO has the responsibility for documenting each inspection on FAA Form 8100-1, 
Conformity Inspection Record, 

so that each product or parl(s) thereof inspected has a complete inspection record.. ." 

Proper adherence to the Order would require: 

1 . Inspections of incoming materials "at the source, if necessary", (e.g. Fuji.) 
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2. Installations, (e.g. in-process inspections of systems installations, major structnra! 
component installations.) 

3. Completed products, (e.g. final inspection of the completed airplanes.) 

This also requires a complete FAA inspection record for each airplane on FAA Form 8 1 00- 1 , (a 
file or book for each airplane.) Instead of inspecting the aircraft during production and 
overseeing incoming materials etc. the ASW inspectors were inspecting the aircraft when it was 
completely assembled. Nonconformances were discovered when the aircraft was presented at 
the end of production and the inspectors blamed Eclipse, yet production under a Type Certificate 
requires the FAA to conduct in process inspections. You failed to ensure the inspections were 
properly conducted in accordance with the above Order. 


Ron Wojnar discovered that FAA employees were concentrating on producing long lists of non- 
conformities rather than assessing the root cause or the criticality of the findings. The inspectors 
needed to be counseled to understand that the task of the Manufacturing Inspection District 
Office (MIDO) inspector is not to document as many discrepancies as possible in the airplanes 
and the quality system, but to work with the manufacturer to address the root cause of the non- 
conformances. Valuable FAA inspector time was wasted trying to rationalize some perceived 
airplane nonconfonnities that were not founded in regulatory requirements. Your personal 
involvement would have surfaced these issues. 

During this period a number of non-confonnities with the wing installations were identified. 
When Ron Wojnar pushed the team to focus on the root cause of the non-conforming wings it 
was found that the MIDO had not conducted an on site visit of the Fuji facility in Japan to assess 
their capability to produce the wing to the Eclipse specifications. The decision not to visit Fuji to 
assess their capability to produce this critical component of the aircraft was made by you. As 
stated above, subsequent to the date of issuance of the TC and prior to the issuance of the PC, the 
MIDO has fill! responsibility for determining whether the product or par1(s) thereof conform to 
the type design and are in a condition for safe operation. This includes performing inspections of 
incoming materials, at the source if necessary. This clearly was not accomplished. Ron Wojnar 
was told that the inspectors advised you of the need to go to Japan but you denied the trip based 
on resource constraints of the continuing resolution even thou^ AJR-l and AVS-1 have 
continually stipulated that priority be given to continued operational safely and surveillance 
activity. Failure to send personnel to evaluate the Fuji facility indicates you do not have the level 
of understanding of the AIR/AVS direction expected of executives or you made a unilateral 
decision to not follow that direction. 

Ron Wojnar also discovered that the inspectors did not undeistand the difference betw^n 
issuing a conforming aircraft a certificate of airworthiness and assessment of a quality control 
program leading to issuance of a Production Certificate. Certificates of Airworthiness were 
being delayol because the production quality control program was inadequate even though the 
aircraft non-conformities could be resolved. This lack of understanding imposed an urmecessary 
burden on the company. You foiled to ensure that your inspectors fully understood Production 
Certificate requirements. 
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It was also discovered tlwt an inspector revoked a cratificate of airworthiness. The FAA can not 
revoke the certificate without taking official certificate action. Issues like this indicate a lack of 
discipline to follow FAA Regulations, Orders and Guidance. It is your responsibility to assure 
that your staff follows FAA Orders and policy and does not require anything of an applicant that 
is not based in regulations. It is not their prerogative to deviate unilaterally. 

Much like the certification program, the team of inspectors did not have an agreed schedule for 
closure of action items and issuance of the Production Certificate. The rationale shared with the 
Ron Wojnar was that the schedule continually slipped therefore it was not worth maintaining. 
Not having an agreed schedule resulted in misunderstandings regarding FAA commitments and 
Eclipse responsibilities. Having apian that is fully endorsed by both the FAA and the applicant 
is fundamental to building relationships and achieving operational results. Without a schedule 
no one was being held accoimtable. 

The Manufacturing Inspection Office had a spreadsheet of things that needed to be accomplished 
prior to issuance of a PC but it had not been fully coordinated with Eclipse. After assessing the 
status of the PC program the first thing Ron Wojnar did was to use that spreadsheet to create a 
Project Specific Certification Plan (PSCP)- The team sat down with the Eclipse Vice Presidents 
of quality and production and worked out a mutually agreed plan with specific criteria for the 
issuance of the PC. The Eclipse personnel were pleased that the FAA not only was committing 
to work toward a PC, but there were actual clear goals and dales, directly traceable to Order 
8120.2D. 


The PSCP contained a section on the airworthiness certification schedule, which they agreed to 
update every Thursday. When the schedule changed because of company issues, it became very 
clear that the FAA was not holding up aircraft deliveries. It is this type of personal involvement 
that we expect of our executives in order to build relationships with our customers and to achieve 
operational results. 

On April 26, 2007, approximately six weeks after Ron Wojnar look over leadership of the 
program, the Production Certificate was issued and a number of aircraft we issu«l airworthiness 
certificates. 

Another area that illustrates your lack of personal involvement was the monitoring of the 
progress toward issuance of the PC prior to the deadline specified in §21.123. The requirement 
for the MIDO to periodically assess the applicant's progress toward an approved production 
inspection system (APIS) or PC, and keep the directorate office apprised is as follows: 

"...25. ASSESSING THE APPLICANT’S PROGRESS. The MIDO/CMO should periodically 
assess the applicant’s progress in complying with the regulations for obtaining approval of an 
APIS or PC. If it appears that the applicant is delaying this action or may not be eligible for an 
APIS or PC by the deadline date, the applicant should be advised in writing of all known 
deficiencies. Also, the applicant should be cautioned that after the deadline date, the FAA will 
not issue any airworthiness certificates or any other approvals unless an extension of the time 
period is authorized by the directorate manager. The MIDO/CMO should keep the directorate 
office apprised as to the applicwit’s progress. . ." 
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An attempt at this may have been made but the 6 months deadline specified in §21 . 123 ran out 
without issuance of an extension letter. If you had been personally involved in the schedule to 
achieve a PC this would have been a major milestone in the original plan. 

As discussed in your mid tenn review we did not see evidence of your persona! involvement in 
addressing the issues that arose during the Eclipse type certification program and after being 
counseled cm the expectation of the level of involvement you failed to interject yourself to that 
level in the production certification activities. 

You have failed to demonstrate the leadership dimensions that comprise the Executive Success 
Profile; (a) Achieving Operational Results, (b) Leading People, (c) Building Relationships, (d) 
Leading Strategic Change. 

(a) Achieving Operational Results 

a. You did not obtain and manage the human capital, financial resources necessary 
to properly support the needs of Eclipse Certification program. 

b. You did not evaluate the failures in the certification program and apply them to 
make improvements in the services provided in the Production Certification 
program. 

(b) Leading People 

a. You did not deal with the conflict between the FAA staff and the Eclipse 
personnel; 

b. You did not mentor the FAA staff on their role in certifying aircraft, or foster 
techniques to build teamwork and cooperation. 

(c) Building Relationships 

a. You did not work with Eclipse management to fully understand the issues and 
communicate those issues to AIR-1 . 

b. You did not act as an unbiased liaison between internal and external stakeholders 
to resolve the issues. 

c. Your relationship with Eclipse is seriously compromised. It is important to 
develop skills to obtain cooperation from others on difficult issues without losing 
their future support. 

(d) Leading Strategic Change 

a. After problems were encountered in the certification of the Eclipse 500 AIR-1 
explained his expectation that you personally engage in managing programs when 
they run into difficulty, and to develop solutions to overcome obstacles. When 
the Eclipse Production Certificate program ran into difficulty you did not meet his 
expectations. 

As an Executive, we expect you to work with the Senior Leadership of our customers. If you do 
not have the necessary resources within your Directorate we expect you to request assistance. If 
you are unfamiliar with the regulations and Orders we expect you to read them or seek advice 
from the process owner (Directorate/Division Executives). 
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Your personal relationship with the Eclipse Executives is deficient. As one of your major 
customers we expect you to work to improve the relationship. 

You are currently not meeting your performance expectations. I am hoping to see an immediate 
improvement in your performance. Please note that if your performance does not improve, you 
may be placed on a formal Opportunity to Demonstiale Perfomiance. 



162 


National Transportation Safety Board 

490 L’Enfant Plaza, SW 
Washington, D.C. 20594 
(202) 314-6000 



Tom Haueter 
Director 

Office of Aviation Safety 
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Testimony of 
Thomas Haueter 

Director, Office of Aviation Safety 
National Transportation Safety Board 
Before the 

Transportation and Infrastructure Committee 
Aviation Subcommittee 
U.S. House of Representatives 

FAA Aircraft Certification: Alleged Regulatory Lapses in the Certification 
and Manufacture of the Eclipse EQ-500 
September 17, 2008 


Good morning Chairman Costello, Ranking Member Petri, and Members of the 
Committee. Thank you for allowing me the opportunity to present testimony on behalf of the 
National Transportation Safety Board regarding the Eclipse 500 airplane. It is a privilege to 
represent an agency that is dedicated to the safety of the traveling public. 

Although the Safety Board is not directly involved in aircraft certification and 
manufacturing processes, the Board strives to improve aviation safety through detailed accident 
and incident investigations and subsequent recommendations. To date, the Board has conducted 
five investigations involving Eclipse 500 airplanes. One of these events occurred 3 years ago, 
and the investigation is complete. The other four events have occurred since April 2008, and the 
investigations are still ongoing. I would like to provide you with a brief description of the 
circumstances of each of these events. 


• On September 3, 2005, an Eclipse 500 was substantially damaged when it landed with its 
landing gear up at Albuquerque, New Mexico. The two commercial pilots were not 
injured. The Safety Board’s investigation found that the pilot did not complete the before- 
landing checklist and failed to extend the landing gear before landing. 

• On April 17, 2008, an Eclipse 500 experienced a stuck rudder trim during a simulated 
single-engine instrument approach to Flint, Michigan. The pilots landed the airplane 
without incident at Pontiac, Michigan. 

• On June 5, 2008, an Eclipse 500 sustained minor damage when its flight crew 
experienced a loss of thrust control at Chicago Midway International Airport. I will 
discuss this event in more detail momentarily because it resulted in the Safety Board’s 
urgent recommendations to the Federal Aviation Administration (FAA). 

• On July 1 7, 2008, an Eclipse 500 sustained minor damage during an in-flight separation 
of the aft lower left side wing-to-body fairing during cruise flight near Rockford, Illinois. 
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• On July 30, 2008, an Eclipse 500 departed the runway while landing at West Chester, 

Pennsylvania. The airplane was substantially damaged, and the two persons on board 

were not injured. 

Regarding the June 2008 incident at Chicago Midway International Airport, the flying 
pilot repotted that, while crossing the runway threshold for a landing attempt, the airplane 
encountered a 10- to 15-knot windshear and developed a high sink rate, which the pilot arrested 
by applying power. The airplane’s touchdown was normal, and the pilot retarded both thrust 
levers to idle. However, shortly afterward, the pilot found that the airplane was accelerating 
rapidly through 100 knots. The pilot confirmed that the thrust levers were at idle, but he noted 
that the engines were at maximum power and that the airplane was continuing to accelerate. 
Because the airplane was rapidly approaching the end of the runway and could not be slowed, 
the pilot decided to abort the landing. 

As the airplane was climbing out, the pilots found that the thrust lever position had no 
effect on power fi'om either engine. The flying pilot lowered the flaps and landing gear to control 
the airplane’s speed. However, the pilots found that, to remain below 200 knots, which is the 
maximum operating speed tor the flaps and landing gear, the airplane needed to maintain a 
shallow climb. The pilots declared an emergency and were cleared by the air traffic control tower 
to land on any runway. 

The pilots noted that the airplane’s engine indicating and crew alerting system displayed 
that the left and right engine full authority digital electronic controls, or FADECs, had failed. 
The pilots referenced the quick reference handbook’s emergency procedures section for engine 
control failure, which contained instructions for a single engine control failure but not for a dual 
engine control failure. The procedures advised that, when one engine control failed, its respective 
engine should be shut down. Thus, the pilots shut down the right engine and began to maneuver 
the airplane toward the runway. However, shortly afterward, they noted that the left engine was 
at idle and would not respond to the thrust lever commands. Fortunately, the airplane had 
sufficient altitude to reach the runway for a successful landing. Without the resourcefulness of 
the pilots, the visual meteorological conditions that prevailed at the time, and the airplane’s 
proximity to the airport, the successful completion of this flight would have been unlikely. 

The Eclipse 500 airplane does not have any mechanical linkage or cables between the 
thrust levers and the engines. Instead, the airplane’s thrust levers are coimected to 
potentiometers that convert the movement of the levers to an electrical signal that is transmitted 
to the engines’ FADECs by electrical wiring. Each FADEC continuously checks itself and the 
opposite engine’s FADEC to ensure that all of the components are working correctly. Each 
engine control has two separate charmels: one is in control, and the other stands by to become 
active if a component in the active channel fails. If both charmels fail, the FADEC software will 
continue to control its engine by reading data from the opposite engine. If both charmels fail on 
both engines’ thrust levers, the FADEC software is programmed to ignore the thrust levers’ 
positions and maintain the requested thrust level of the last valid thrust lever position. 

Tests have fotmd that, when the thrust levers on the Eclipse 500 were pushed against the 
maximum power stops using a normal application of force — that is, a force that a pilot might 
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normally use during flight — it was possible to cause the control system to detect an out-of-range 
setting that would result in an engine control failure. These faults could be cleared by cycling 
the electrical power to the FADECs. 

The findings of the investigation to date indicate that it is likely that the pilot advanced 
the thrust levers up to the maximum power stops when reacting to the windshear to arrest the 
sudden increase in the sink rate. This action likely caused the dual channel failures in both thrust 
levers. Then, because of the programming logic of the FADEC software, the engines maintained 
the thrust level of the last valid thrust lever position. In this case, that position was at, or nearly 
at, maximum power, so the engines remained at that high power setting. 

During this incident, the fault in the right engine was cleared when the flight crew shut 
down that engine. However, because the FADEC software was programmed so that the left 
engine would mirror the thrust lever position of the no-fault right engine, which was positioned 
at idle after shutdown, the power in the left engine was reduced to idle. After the pilots shut 
down the right engine to attempt to regain engine control, it is likely that the left engine rolled 
back to idle immediately. Thus, the pilots were flying with one engine that was shut down and 
another engine that would not advance past idle, and they had no emergency procedures to 
address the situation. 

This dual channel failure of both thrust levers occurred after the airplane had 
accumulated only 238 hours and 192 cycles since new. The thrust levers are part of the throttle 
quadrant assembly. The Safety Board’s investigation found that other throttle quadrant 
assemblies failed in a similar manner during testing, which suggested that there might be a 
design or quality problem in the Eclipse 500’s throttle quadrant assembly. 

On June 12, 2008, one week after the incident at Chicago Midway International Airport, 
the Safety Board issued two urgent recommendations to the FAA. The first recommendation, A- 
08-46, asked the FAA to require an immediate inspection of all Eclipse 500 airplane throttle 
quadrants to ensure that pushing the throttle levers against the maximum power stops would not 
result in an engine control failure and to require that any units that fail the inspection be replaced 
and that the replacement parts be similarly inspected. On the same day, the FAA issued an 
airworthiness directive to require pilots of Eclipse 500 airplane to evaluate the throttle quadrants 
to see if a control fault would occur. 

Eclipse has since developed an FAA-approved test procedure and issued an alert service 
bulletin that provided standardized procedures for testing and, if necessary, modifying the thrust 
lever. In August 2008, the FAA superseded its original airworthiness directive to mandate the 
Eclipse alert service bulletin, which is to be accomplished by a person who is authorized to 
perform maintenance. 

The Safety Board’s second urgent recommendation, A-08-47, asked the FAA to require 
Eclipse to immediately develop an emergency procedure for a dual engine control failure on the 
Eclipse 500 airplane and then to incorporate the procedure into the airplane flight manual and 
quick reference handbook via an airworthiness directive. 
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Eclipse developed emergency procedures for a dual engine control failure, and the FAA 
issued an airworthiness directive stating that these procedures were to be incorporated into the 
airplane flight manual and the quick reference handbook. Eclipse also reprogrammed the 
FADEC logic to limit the thrust lever out-of-range angle and not make it a hard fault so that, 
when the thrust lever was retarded to below the out-of-range angle, the FADECs would resume 
reading the thrust lever position. These FADEC logic changes were to be incorporated into 
Eclipse 500 airplanes while they are at service centers for maintenance. 

This concludes my prepared statement. I will be happy to answer any questions you may 

have. 
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National Transportation Safety Board 

Washington, D.C. 20594 

OCT 1 7 2008 


Honorable Jerry F. Costello 
Chairman 

Subcommitee on Aviation 

Committee on Transportation and Infrastructure 

U.S. House of Representatives 

2251 Rayburn House Office Building 

Washington, D.C. 20515 

Dear Mr. Chairman: 

Enclosed are the responses of Thomas E. Haueter, Director of the Office of Aviation 
Safety, to questions regarding his September 17, 2008, testimony before the Subcommittee on 
“FAA Aircraft Certification: Alleged Regulatory Lapses in the Certification and Manufacture of 
the Eclipse EA-500.” 

Owing to the October 17, 2008, deadline noted in your letter, Mr. Haueter, who is 
currently attending the ICAO Meeting in Montreal, has asked me to transmit his responses to 
you. 


If I may be of further assistance to you in this matter, please do not hesitate to contact me 
at 202-3 14-6006. 


Sincerely, 





Brenda Lee Yager, Director 
Government and Industry Affairs 


Enclosure 
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FAA Aircraft Certification; Alleged Regulatory Lapses in the Certification and 
Manufacture of the Eclipse EA-500 


1. Mr. Haueter, Given the complexities of the aircraft and the fact that the FAA 
test pilots recommended or wanted it not to be certificated as single-pilot but 
two-pilot, do you agree with the FAA’s decision to certify it as a single-pilot? 

I am not aware of the detailed findings of the FAA test pilots or subsequent actions 
taken to resolve any Issues identified by the FAA test pilots. Therefore, it is difficult 
for me to agree or disagree with the FAA’s decision to certificate the airplane for 
single-pilot operations. Additionally, the Safety Board is not involved in the FAA’s 
certification process; however, I would expect that the findings of the FAA test pilots 
would be a major factor in the final certification of an airplane. At this point in time, 
however, the Safety Board has no official position on this issue. 


2. What are the experience levels of the pilots operating the jet at Midway on June 
5th? 

The pilot in the left seat reported that he had over 21,000 hours of total flight time, 
including over 300 flight hours in the EA-500. He had type ratings in Boeing 727, 
737, McDonnell Douglas DC-3, and E>C-9 airplanes; Convair 240, 340, and 440 
airplanes; and Lockheed 382 and 1 129 airplanes. The pilot in the right seat reported 
that he had 2,400 hours of total flight time, including 89 flight hours in the EA-500. 


3. Mr. Haueter, do you think that the June 5th incident could have been a fatal 
incident if there was one pilot operating the jet, of if even two less experienced 
pilots were operating the jet? Do you think that a single pilot would have had 
time to reference the manual in a similar incident? Also, has that situation 
occurred in any other flight of this aircraft? 

It is definitely a benefit to have two pilots on board in an emergency situation, 
because this allows one pilot to fly the airplane while the other references the 
airplane’s manuals. One of the keys to a successful landing on June S**" was that the 
pilots of the accident airplane chose to remain in close proximity to the airport while 
they evaluated the engine control problem. Certainly having two pilots facilitated 
their trouble-shooting efforts while essentially remaining in the airport traffic pattern. 
Had they chosen to fly farther firom the airport, it is unlikely that they would have 
been able to make a successful landing. However, it is also still possible that a single 
pilot or a less experienced crew could have managed a successful landing. We are not 
aware of a loss of engine control on another EA-500 aircraft. 
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4. Mr. Haueter, are you comfortable that the FAA certified this aircraft for single- 
pilot operation, given its complexity, over the objections of the FAA’s own test 
pilots? 

The EA-500 appears to be of similar complexity to other light jet aircraft, such as the 
Cessna Citation and Cessna Mustang, which have been certificated by the FAA for 
single-pilot operations. Advances in avionics and systems have enabled smaller 
crews, to include single pilots, to better manage flight operations. I do not know the 
specifics of the FAA test pilots’ concerns or the resolution of those concerns. 
However, I would be uncomfortable with any certification process if their concerns 
were not resolved prior to the aircraft being certificated. At this point in time, 
however, the Safety Board has no official piosition on this issue. 


5. Does the NTSB have concerns that the EA-500 has experienced an unusual 
number of problems given the small numbers of aircraft currently operating in 
the system? 

The Safety Board has investigated 2 accidents and 3 incidents involving the EA-500. 
Additionally, we are aware of many of the Service Difficulty Reports (SDR) and 
Aviation Safety Reporting System (ASRS) reports regarding the EA-500. The Safety 
Board does not have the data to compare these reports to those of other aircraft upon 
initial introduction of a new fleet. The number of reports has prompted greater 
scrutiny by our investigative staff, and the Safety Board’s investigative staff 
continues to monitor the SDR and ASRS reports and their relevance to our accident 
and incident investigations. 
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FAA AIRCRAFT CERTIFICATION: ALLEGED REGULATORY LAPSES IN THE 
CERTIFICATION AND MANUFACTURE OF THE EA-500 

September 17, 2008 
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Testimony of Clyde R. Kizer 
Retired Aerospace Executive 
Before the 

Committee on Transportation and Infrastructure Subcommittee on Aviation 
Regarding 

FAA AiRCRAFT CERTIFICATiON: ALLEGED REGULATORY UPSES IN THE CERTIFICATION AND 
MANUFAaURE OF THE EA-500 

September 17, 2008 


BACKGROUND 

U.S. Naw (1960-19821 

Active Duty (1960-1974) 

Reserves (1974-1982) 

Naval Officer/ Aviator/Experimental Test Pilot 
Retired with the rank of Captain 

I served two combat tours in Southeast Asia, flew as an Experimental Test Pilot for two tours at the 
U.S. Naval Air Test Center, NAS Patuxent River, Maryland, served as the Executive Officer then 
Commanding Officer of a squadron and retired with the rank of Captain with over 30 service awards. 

United Airlines (1974-1988) 

Engineering Test Pilot (1974-1982) 

Director Engineering (1982-1984) 

Vice President Technical Services (1984-1988) 

My responsibilities included ail aspects of engineering, quality assurance, quality control, flight test 
and technical publications for the (then) iargest air carrier in the free world. During my tenure of 
technical leadership the fleet underwent unprecedented growth from 7 aircraft models with 7 
different engine types to 22 aircraft models with 23 different engine types; the first National Aviation 
Safety Program inspections were conducted; United conducted a number of STC and alternate means 
of compliance initiatives; and, the airline never received a civil penalty for failure to comply with 
regulatory requirements. 

Air Transport Association (1988-1990) 

Vice President Engineering and Maintenance 

During my tenure at ATA, I initiated and led the activities of the Airworthiness Assurance Task Force 
following the structural loss of a significant portion of upper fuselage skin on a 737 aircraft. Other 
responsibilities included industry interface for ail U.S. Government technical organizations (military 
and civil); coordination of general industry activities related to certification, regulation, and rule 
making; interface for international air transport and regulatory activities (lATA, ICAO, JAR, etc.); 
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interface for general airline/manufacturer activities (Boeing, Douglas, Lockheed, Airbus, Convair, etc.); 
and coordination with all other Industry associations (union, civil, technical, professional, etc.). 

Midway Airlines (1990-1992) 

Senior Vice President Operations 

I served as Senior Vice President Operations (flight operations and maintenance) for Midway Airlines 
until Midway declared bankruptcy In 1992. 

Airbus Industries North America— Customer Services (1992-2004) 

President/coo 

Responsible for all customer service activities (training, spares and material control, publications, field 
engineering, maintenance, engineering, regulatory coordination, contract administration) for North 
America Airbus operators, as well as for training and spares/material control for South America Airbus 
operators. 

ORGANIZATIONS (some no longer current since retirement) 

American Institute of Aeronautics and Astronautics (AIAA); former member of the Honors and Awards 
Committee 

Society of Automotive Engineers (SAE) 

Society of Experimental Test Pilots 
Flight Safety Foundation 
Sperry Award Committee 
Quiet Birdmen 

BOARDS 

Chairman/Vaughn College Board of Trustees (1997 to present) 

Chairman/Discovery of Flight Foundation— in support of Wright Experience/Wright aircraft 
reproductions (2005 to present) 

Board of Trustees/Couneil on Aviation Accreditation (2004) 

Chairman/Doll Technology Board of Directors (2003 to 2006 approximate dates) 

Member Board of Directors/TIMCO (MRO facility) (2004 to 2006 approximate dates) 

Congressional Medal of Honor Society Golf Classic/Executive Committee (2005) 

EDUCATION/TRAINING/DESIGNATIONS 

Bachelor of Science Degree/Blo-Chemistry/Eastern Michigan University (1960) 

Designated; U.S. Naval Aviator (1961) 

Designated: U.S. Naval Air Intelligence Officer (1963) 

Designated; Special Weapons Handling Officer (1964) 

Graduate: U.S. Naval Test Pilot School (1965) 

Designated: U.S. Naval Aeronautical Engineer (1968) 

Designated: U.S. Naval Weapons Systems Procurement Officer (1968) 

Senior Executive Program/Stanford University (1986) 

FAAUCENSES 
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Airline Transport Pilot 
Airplane Multl-engine/Land 

B-727, B-737, B-747, B-7S7/767, DC-8, DC-10 
Commercial Privileges 
Airplane Single Engine Land and Sea 
Rotorcraft-Helicopter SK-61 

Single-engine/Sea 
Rotor-craft; Helicopter 
Flight Engineer Turbojet Powered 

(note; rated In B-747, DC-10 and DC-8 aircraft by UAL) 

INDUSTRY ACTIVITIES 

FAA Airworthiness Directive Compliance Team — 2006-15-15 (2008) 

FAA Airworthiness Directive Compliance Team— AD Process Review Team (2008) 

National Research Council/USAF Non-Tactical Aircraft Re-engine Study (2006) 

National Research Council/USAF Non-Tactical Aircraft Winglet Study (2007) 

National Research Council/U.S. Aviation Research Capabilities Study (200S) 

National Research Council/U.S. Air Transport Industry Safety— Technical Study (2004) 

Ad Hoc Team to Review VU/UA Certification/Operational Considerations: Nicholas A. Sabatini, 
Associate Administrator for Aviation Safety (~2004) 

U.S. Congress, Office of Technology Assessment/ Safer Skies With TCAS: Traffic 
Alert and Collision Avoidance System-A Special Report (1989) 

EMPLOYMENT STATUS 

Although I provide my time, experience and opinions to those who request it on a regular basis, I am 
retired and, by choice, have never received pay (other than expenses) as a consultant. Except for my 
position on the Board of Directors at TIMCO, all of my industry activity, since retirement, has been 
with government, government sponsored, or non-profit, organizations related to improving safety, 
technology and operations within the aerospace Industry. 
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STATEMENT 

My name is Clyde Richard Kizer and my statements reflect observations, facts and opinions garnered 
over a 44 year career in the aerospace industry. 

I realize that the focus of these hearings is on the certification of the Eclipse EA-SOO. My statement 
today relates to the requisite requirement for the concept of "alternate method of compliance” to 
assure a vibrant environment of innovative engineering and technology development for the 
aerospace industry. Absent the application of technical vision and the exploration of new materials, 
concepts and processes our nation will rapidly fall behind in this globally critical industry. 

My comments relate specifically to the need for a methodology that allows consideration of alternate 
means of compliance within the regulatory process. My experience and training relates 
predominately to the arena of airline aircraft continued airworthiness, and I will focus my comments 
to that portion of the industry, but the concepts that I discuss have value for all venues of technical 
development, albeit with differing practical priorities, frequencies of application and regulatory 
oversight requirements. 

Equally important to the success of the aerospace industry as the alternate method of compliance is 
the development of, and adherence to, minimum standards for regulatory compliance to assure the 
safety of the aircraft, the public and the national air space. 

The remarkable safety record of the U.S. Air Transport Industry is a result of the robust process of 
communications, coordination and exchange of technical information that exists between the 
operators, the manufacturers and the regulatory agency. No single entity within these constituents 
can assure the desired level of safety independently. The success of the endeavor depends on 
effective collaboration. The free exchange of technical information provides a venue for Innovative 
alternative technical resolution of potential problems from differing perspectives of responsibility. 
Over time, this process allows a variety of methods for technical problem resolution from which it is 
possible to develop a "best practices" resolution for standardization, effectiveness and efficiency. 
Absent such an approach standardization might potentially be achieved by forced adherence to the 
least effective method. 

Over decades of commercial air travel many new technologies have been developed to improve the 
safety and efficiency for the travelling public. Emerging technologies demand a conservative 
approach for application, operation and regulatory control to assure that the safety of the system Is 
not compromised. That conservative approach results in the establishment of minimum standards of 
performance that protect the industry while allowing flexibility in the development of new 
technologies. Unfortunately, the term "minimum standards" occasionally connotes an atmosphere of 
laxity when, in fact, it is just the opposite— a restrictive set of requirements that must be met in the 
very conservative approach to development of new technologies and/or methods for resolution of 
technical problems. 

It is a general truth that no two aircraft leave the manufacturer’s production line in exactly the same 
configuration. Additionally, once an aircraft enters service, no two aircraft of similar type are in 
exactly the same configuration— within a given airline, or between airline fleets. The responsibility of 
the airlines is to maintain their aircraft so that they conform to the type design and type certification 
requirements that were established to assure airworthiness for the certification and production of 
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commercial aircraft. This requirement for conformance is termed "continued airworthiness". The 
continued airworthiness process includes incorporation of methods to address any action that 
modifies the original type certification requirements, such as Airworthiness Directives, Supplemental 
Type Certifications, etc. The airlines dedicate considerable technical resources for maintenance and 
engineering activities to meet this responsibility. 

When technical problems are defined and addressed by manufacturer service bulletins, or regulatory 
requirements, the specified means of corrective action frequently requires variations due to 
configuration differences, material applications, or other considerations. When corrective actions are 
mandated by the FAA, generally by issuance of an Airworthiness Directive (AD), such actions 
frequently include a means to employ differing methods, materials and/or timing to accomplish the 
mandatory action. These alternatives are allowed only after approval by the FAA Aircraft Certification 
Office designated in the AD. FAA approval for alternative methods must be obtained prior to the 
required date for completion of the action defined in the AD. This approach is prescribed in 14 CFR 
part 39 as the Alternative Method of Compliance, or AMOC, process. The AMOC process allows 
accommodation for alternatives thatmight not have been known, or considered at the time the AD 
was written. The primary requisite for this process rests with a determination that the alternative 
provides an acceptable level of safety that is equivalent to that required by the AD. 

As a comparison of the viability of the alternative methodology, a similar process is permitted during 
certification by long standing regulation [14 CFR 21.21 (a) (1)]: "Upon examination of the type design, 
and after completing all tests and inspections, (a type certificate is awarded if the Administrator finds] 
that the type design and the product meet the applicable noise, fuel venting, and emissions 
requirements of the Federal Aviation Regulations, and further finds that they meet the applicable 
airworthiness requirements of the Federal Aviation Regulations or that any airworthiness provisions 
not complied with are compensated for by factors that provide an equivalent level of safety. 

It is obvious that the AMOC and equivalent level of safety (ELOS) processes allow consideration for 
differing technical expertise, varying operational experiences, new technologies and innovative 
methodologies while protecting the safety and efficacy of the air transport system and not 
compromising the responsibility, or prerogatives, of the Regulatory Authority. The Intent of the 
AMOC/ELOS processes is to maintain, or improve, the safety of aircraft and the industry while 
allowing the employment of technical innovation and new technologies to resolve technical problems. 
Over many years, the concept of alternative methods of compliance has proven to be a safe and 
effective approach for regulatory compliance. The AMOC/ELOS processes have provided essential 
alternatives that are crucial to the air transport industry and my experience is that it is equally ssential 
for general aviation. 
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ISouaj of iSEprEBcntatiuea 
Comirattee on tCransiportation anlt infrastrurture 

jramci S. ^eriftar 
C^trtnan 


Dsvtd Stejmrieid, a&tS oTStaff 
Word W. MeCana^xr, CKI«{ Comiwl 


Wa^btngton, BC 20515 


September 30, 2008 


Sobn 3L. iSIica 

^anfaing Sl^u&licanifienAer 


JgjTM* W. CooB il, RcptiUican (^ilcf (dStaff 


Mr. Clyde Kizer 
4287 Ringwood Road 
Nokesville, Virgima 20181 

Dear Mr. Ki 2 »r: 

On September 17, 2008, you were a witness at a Subcommittee on Aviation 
hearing on die certification of &e Eclipse 5(K> aircrait I thank you for your participation 
and ask that you provide written responses to the Committee on the following questions- 
fOT-the-recoid: 


> Some have characterized "alternative means ofcompliaiK^** as a "loophole." Is 
tiiat a foir and correct representation? you characterize the negative effects to 
aviation if such alternate m^s of compliance were not allowed? 

> Is it common fmr design issues on aircraft to be discovered in service even after 
the certification process is complete? 1$ it evai reasonable to assume that every 
design flaw will be found during the process? What are some examples of 
aircraft, othor foan the Eclipse SOO, where Airworthiness Directives were written 
to solve design flaws after type certificaticm? 


Thank you for youT kind attention to this letter and please let me know if you have 
any fiirthCT questions. 


SincCTely, 



Ranking Republican Memb^ 
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October 17, 2008 


The Honorable John L. Mica 
Ranking Republican Member 
Committee on Transportation 
and Infrastructure 
U.S. House of Representatives 
Washington, DC 20515 

Ref; Itr. Dated September 30, 2008 

Dear Congressman Mica; 

In accordance with your letter dated September 30, 2008, I am submitting the following comments in 
response to the questions contained in that correspondence. If these responses do not adequately 
satisfy the intent of the queries, I will be pleased to provide whatever additional input that is required. 

Thank you for the opportunity to address the issue of "alternative means of compliance" as a 
methodology to assure continued air worthiness for the air transport fleet of aircraft as well as the 
concept of "equivalent level of safety" as a counterpart methodology to the aircraft certification 
process. 


Sincerely, 
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COMMENTS IN RESPONSE TO QUESTIONS FOR THE RECORD 

Clyde R. Kizer 
October 17, 2008 


Questions for the record : 

Some have characterized the "aKemative means of compliance" as a 'Toophole." Is that a fair and 
correct representation? Can you characterize the negative effects to aviation if such aKemative 
means of compliance were not allowed? 

Response : 

Alternative Means of Compliance (AMOC) is a regulatory methodology provided for technical problem 
resolution for the process of continued air worthiness (in-service maintenance of aircraft 
airworthiness) in the air trani^rt industry. A similar methodology termed the "equivalent level of 
safety (ELOS) processes” is permitted during certification by long standing regulation. The intent of 
the AMOC/ELOS processes is to maintain, or improve, the safety of aircraft and the industry while 
allowing the employment of technical innovation and new technologies to resolve technical problems. 
Over many years, the concept of alternative methods of compliance has proven to be a safe and 
effective approach fer regulatory compliance. Both processes allow consideration for differing 
technical expertise, varying operational experiences, new technologies and innovative methodologies 
while protecting the safety and efficacy of the air transport system and not compromising the 
responsibHity, or prerogatives, of the Regufetory Authority. 

The varying approaches provided by aKernate means of compliance allow the potential for ultimate 
industry standardization In the form of "best practices" as those best practices are manifested over 
time. Absent aKemative means of compliance, the industry might be forced to apply the least 
efficient, or most expedient, approach to technical problem resolution in terms of safety and 
effectiveness. 

Failure to develop innovative engineering and new technologies to address improved safety and 
effectiveness (efficiency and economics) of the aviation industry would have an extremely adverse 
impact on aviation safety and could drive industry users to superior products from Europe and Asia. 
Absent the challenge to creativity udthin the industry supplied by alternate means of compliance, our 
technically trained personnel might seek venues outside of the United States to exercise their 
creativity. 

The AMOC/ELOS processes have provided essential alternatives that are crucial to the air transport 
industry. 
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COMMENTS IN RESPONSE TO QUESTIONS FOR THE RECORD 
Clyde R.Kizer 

October 17, 2008 


Questions for the record ; 


Is It common for design issues on aircraft to be discovered in service even after the certification 
process is complete? Is it even reasonable to assume that every design flaw will be found during the 
process? What are some examples of aircraft, other that the Eclipse 500, where Airworthiness 
Directives wee written to solve design flaws after type certification? 

Response : 

Design ^ues discovered in service: By definition. Airworthiness Directives change the original type 
certificate for an aircraft from the approved type des^n. This procedure establishes a demonstrated 
need to redefine the design specifications . The regulatory action is implemented to address a number 
of existing, or potential, disaepancy classifications: 

1. Thoi^h the probability for a known fault or failure to occur may be remote new technology, 
materials or engineering concepts allow such a significant improvement in the air worthiness 
status that it must be implemented. 

2. Faults, or failures, are deternrined that were never anticipated, or tested for, during the 
certification process. 

3. The original certification process did not adequately address failures, of faults, resulting from 
unintended human interaction. 

4. Though the aircraft demonstrated compliance with certification requirements, materials, 
processes, or designs were not robust enough to withstand the rigors of normal operational 
use. 


Every flaw to be determined during certification: The complexity of modem transport aircraft is so 
great that the number of potential failures resulting from design, material, production variance, and 
human interaction faults is virtually Infinite. Since it Is impossible to investigate an infinite number of 
variables in the finite peifod of time allocated for certificatton, many faults and failures are not 
manifested until a relatively large number of aircraft accumulate service experience, hence exposure 
to the failure mode, exponentially. 

Examples of in-service design issue determination: Attachment i is provided as a random search of 
recent ADs for which the apparent intent was to rectify a design Issue that was not determined during 
the certification process. 

The following are posonal experiences where ADs, or operational variances, were required to 
accommodate technical problems not determined during the certification process: 
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1. Design redundancy protects tiie integrity of critical functions in the event of a single, or even 
multiple, failures. Historically, where failure modes have been demonstrated to be a function 
of time, or frequency, the industry has mixed and matched affected components (flight 
control surface, flight control system components, engines, etc.) to minimize the exposure to 
multiple failures. This situation occurred early in the service life of the Boeing 767 (around 
1984} aircraft when time/cycle related delimitation of composite f%ht control surfaces were 
manifested. The airlines mixed new controls with older controls to preclude simultaneous 
failures. No serious failures were encountered in operation. 

2. In the era of digital electronics, computer driven and integrated system transport aircraft a 
number of faults and failures have developed in asSodation with the new technology. A 
common failure mode for first generation digital electronic equipment resulted from power 
transients, or system interface, difficulties. Airport ground power sources are notoriously 
"ditty” with respect to frequency and amplitude control of output ac power and, since d^tai 
equipment lives in an analog world, the interface frequently caused unexpected feults or 
feilures. It u«s not uncommon, in my experience, to have to reset, or reinitialize, d^tal 
electronic indicators or systems (A320 aircraft) following power transients when shifting 
between ground, APU and engine-driven power sources. Likewise, d^ital display failures 
have occurred as the result of power spikes in operation. 

3. It is not uncommon for design faults or failures to manifest themselves many years after the 
entry into service for an aircraft. The DC-IO and 747 (Explosive Decompression - Loss of Cargo 
Door in Flight, United Airlines Flight 811 Boeing 747-122, N4713U Honolulu, Hawaii, February 
24, 1989. Revised NTSB Report Number: AAR-92-02, adopted on 3/18/1992) cargo door design 
problems did were not identified until each aircraft had been in service for over 10 years. 

4. The certification of the DC- 10-10 included the capability for CAT 11/ Autoland which gave the 
aircraft autoflight capability to the (then) lowest ceiling/visibility limits to include an autopilot 
controlled landing. After a few years of operations of the DC- 10- 10 aircraft, the carriers with 
the two largest fleets in North America, United Airlines and American Airlines, experienced 
excessive, and operationally unacceptable, touchdovm dispersions and rates during autoland 
operations. Both carriers participated with the FAA and Douglas in an extended evaluation 
program to investigate potential causes for the problem. The evaluation showed that, even 
tiiough the aircraft and its systems were certified for CAT 11/ Autoland, the tolerances in the 
electronic components that biterfeced in the autoflight mode to provide that capability could 
not be retained over time by airline maintenance practices. The resolution to this certification 
anomaly required that the aircraft be precluded from Autoland operations uniter CAT il 
conditions, or that newer components be purchased with the capability to retain the required 
tolerances for CAT li/Autoiand operations. United Airlines opted to restrict their DC-10- 10 
fleet from Autoland operations under CAT II conditions. 


This brief summary, and the attached survey of recent Airworthiness Directives, demonstrates that, 
even though properly certificated, Airworthiness Directives, and operational procedures, are 
sometimes required to assure safe and reliable operation of for some aircraft. 
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Attachment I 


BRIEF REVIEW OF DESIGN RELATED AIRWORTHINESS DIRECTIVES 


1. EMBRAER: This AD results from a report of smoke in the cockpit . We are issuing this 
AD to prevent ienition of a windowsill drain hose bv an overheated relay, which could 
cause fire and smoke in the cockpit. (Design problem not determined daring 
certification.) 

2. McDonnell Douglas: This AD results from the determination that the thrust reverser 
systems on McDonnell Douglas Model DC-8-62, DC-8-63, DC-8-62F, and DC-8-63F 
airplanes do not adequately preclude inadvertent deployment of the thrust reversers. We 
are issuing this AD to prevent inadvertent deployment of the thrust reversers during 
takeoff or landing, which could result in loss of control of the airplane. (Design problem 
determined after years of operational experience.) 

3 . Boeing Model 747-400 series airplanes: This AD results from reports of decompression 
panels on the smoke barrier opening in flieht and on the ground without a decompression 
event. We are issuing this AD to prevent inadvertent opening or tearing of decompression 
panels, which could result in degraded cargo fire detection and suppression capability, 
smoke penetration into an occupied compartment, and an uncontrolled cargo fire, if a fire 
occurs in the main deck cargo compartment. (Design problem determined after years 
of operational experience.) 

4. Airbus Model A300 airplanes: This AD results from fuel system reviews conducted by the 
manufacturer. We are issuing this AD to reduce the potential of ignition sources inside fuel tanks, 
which, in combination with flammable fuel vapors, could result In fuel tank explosions and 
consequent loss of the airplane. (No design problem determined, but new design provides 
significant improvement to prevent potential problem.) 

5. Airbus Model A330: This AD was prompted by reports of detached and damaged float 
valves in the left and right fuel tanks of the trimmable horizontal stabilizers (trim tanks). 
We are issuing this AD to prevent, in the event of a liehtnim strike to the horizontal 
slabilizer. sparldne of metal parts and debris from detached and dama^d doat valves , or 
a buildup of static electricity, which could result in ignition of fuel vapors and consequent 
fire or explosion. (Though properly certified, failure mode existed that was not 
manifested during the certification process.) 

6. BoeingModel 747SP, 747SR, 747-100, -lOOB, -lOOB SUD, -200B, -200C, -200F, and - 
300 series: To prevent improper deployment of the escape slide/raft or hlockaee of the 
passeneer/crew doors in the event of an emergency evacuation, which could result in 
injury to passengers or crewmembers, accomplish the following: Modify the escape 
slide/raft pack assembly in accordance with Boeing Swvice Bulletin. (Improved design 
addresses potential original design problem manifested after years of operational 
experience.) 

7. Boeing Model 777-200 series airplanes: This AD results from fuel system reviews 
conducted by the manufacturer. We are issuing this AD to prevent enerp/from a 
liehtnim strike on the bushine for the sumo drain valve from arcing to the inside of the 
center fuel tank wall, which could create an ignition source in the fuel tank and result in a 
fuel tmik explosion. (No des^n problem determined, but new design provides significant 
improvement to prevent potential problem.) 


1 
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Attachment I 


8. Bombardier Model CL-600-2B19: This AD results from a report that the shear pin 
located in the irtput lever of two pitch feel stimulator CPFS) units failed due to fatipte . 
We are issuing this AD to prevent undetected failure of the shear pin of both PFS units 
simultaneously, which could result in loss of pitch feel forces and consequent reduced 
control of the airplane. (Though properly certified, failure mode existed that was not 
manifested during the certification process.) 


2 
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Testimony Statement 


Ford J Lauer III 
Manager 

Federal Aviation Administration 
Manufacturing Inspection District Office 
10100 Reunion Place, Suite 650 
San Antonio, Texas 78216 


Aircraft Certification: Alleged Regulatory Lapses in the 
Certification and Manufacture of the Eclipse EA-500 


Given before the U.S. House of Representatives Committee on 
Transportation and Infrastructure’s Subcommittee on 
Aviation on September 17, 2008 
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Statement of Ford J Lauer III, Supervisory Aviation Safety Inspector/Manager, San 
Antonio Manufacturing Inspection District Office, Rotorcraft Directorate. 

Given before the U.S. House of Representatives Committee on Transportation and 
Infrastructure’s Subcommittee on Aviation on September 17, 2008: 





In July of 2006, 1 was appointed as a new probationary 
Supervisory Aviation Safety Inspector and Manager of the San Antonio Manufacturing 
Inspection District Office. The San Antonio Manufacturing Inspection District Office is 
staffed by a manager, five aviation safety inspectors, and an administrative assistant. The 
San Antonio Manufacturing Inspection District Office has geographical responsibility in 
the states of Texas, Louisiana, and New Mexico. The San Antonio Manufacturing 
Inspection District Office reports to the Rotorcraft Directorate Manufacturing Inspection 
Office. The Fort Worth Manufacturing Inspection District Office and the Oklahoma City 
Manufacturing Inspection District Office both also report to the Rotorcraft Directorate 
Manufacturing Inspection Office. At the time of my appointment as the San Antonio 
Manufacturing Inspection District Office Manager, FAA manufacturing inspection 
responsibilities for the Eclipse project were under the authority of a Program Manager 
assigned by the Rotorcraft Directorate Manufacturing Inspection Office. Since I was a 
newly appointed manager and was unfamiliar with the Eclipse project, the Manager of 


NOTE: Shaded text reflects the oral summary portion of the statement 
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Statement of Ford J Lauer III, Supervisory Aviation Safety Inspector/Manager, San 
Antonio Manufacturing Inspection District Office, Rotorcraft Directorate. 

Given before the U.S. House of Representatives Committee on Transportation and 
Infrastructure’s Subcommittee on Aviation on September 17, 2008: 

the Rotorcraft Directorate Manufacturing Inspection Office elected to maintain the 
assigned Program Manager in place rather than turn the Eclipse project over to me. In 
this capacity I assisted the Program Manager as a subordinate. In late December of 2006, 
the assigned Program Manager moved on to other duties, and I was given more 
responsibility on the Eclipse project. Specifically, those responsibilities consisted of 
coordinating and scheduling an FAA District Office Audit in connection with the Eclipse 
application for a Production Certificate, and airworthiness certification of Eclipse 
airplanes manufactured under type certificate only. In addition to personally conducting 
these activities at the Eclipse facilities in Albuquerque, New Mexico, I also assigned 
FAA inspectors from the San Antonio Manufacturing Inspection District Office to 
conduct these activities on a rotational basis. Because of the nature of the Eclipse 
project, 1 never had the relative autonomy or decision making authority FAA 
Manufacturing Inspection District Office managers typically have on similar projects. 

All decisions and actions were coordinated with and concurred with by the Manager of 
the Rotorcraft Directorate Manufacturing Inspection Office prior to implementation. 



NOTE: Shaded text reflects the oral summary portion of the statement. 
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Statement of Ford J Lauer III, Supervisory Aviation Safety Inspector/Manager, San 
Antonio Manufacturing Inspection District Office, Rotorcraft Directorate. 

Given before the U.S. House of Representatives Committee on Transportation and 
Infrastructure’s Subcommittee on Aviation on September 17, 2008: 



Functional Test Procedures are common in the industry, and are used to test various 
aircraft systems for proper operation before releasing the aircraft for flight. The Program 
Manager and I observed numerous instances where the Eclipse functional test procedures 
were not being complied with. For example, tools referenced by part number in the 
functional test procedures were identified with different part numbers and in some cases 
tools completely different than those called out were being substituted. Oils, hydraulic 
fluids, and other materials called out in the functional test procedures were also being 
substituted. Rather than complying with or revising the functional test procedures, 
identifying tools properly, or obtaining the referenced tools and materials as applicable. 
Eclipse elected to sign off the functional test procedures as being properly accomplished. 
The Program Manager and I also conducted conformity inspections to verify that aircraft 
were manufactured in accordance with the design drawings included in the Type 
Certificate. Numerous nonconforming characteristics were observed, such as improperly 
installed fasteners, misrouted electrical wiring, unsatisfactory safety wire, wrong 
fasteners being used, inadequate clearances between moving parts, etc. The Program 

NOTE: Shaded text reflects the oral summary portion of the statement. 
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Statement of Ford J Lauer III, Supervisoiy Aviation Safety Inspector/Manager, San 
Antonio Manufacturing Inspection District Office, Rotorcraft Directorate. 

Given before the U.S. House of Representatives Committee on Transportation and 
Infrastructure’s Subcommittee on Aviation on September 17, 2008: 

Manager gathered the Eclipse inspectors and supervisors, and instructed them to 
thoroughly inspect the airplanes and functional test procedures, and to have them revised 
where necessary. Additionally, Eclipse personnel were instructed that airplanes and 
functional test procedures should not be signed off and presented for FAA inspection 
unless everything was correct. On subsequent visits to Eclipse, the Program Manager, I, 
and other FAA inspectors encountered the same or similar issues on other airplanes being 
presented for FAA inspection. Through a preexisting agreement between Eclipse and the 
FAA, it had been established that the Eclipse FAA designees would accomplish key 
inspections and witness functional test procedures. When FAA inspectors re-inspected to 
verify that the Eclipse FAA designees were performing adequately, nonconforming 
characteristics were consistently observed. 



NOTE: Shaded text reflects the oral summary portion of the statement. 
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Statement of Ford J Lauer III, Supervisory Aviation Safety Inspector/Manager, San 
Antonio Manufacturing Inspection District Office, Rotorcraft Directorate. 

Given before the U.S. House of Representatives Committee on Transportation and 
Infrastructure’s Subcommittee on Aviation on September 17, 2008: 



Having to maintain a virtually constant FAA inspector presence at Eclipse had 
a huge effect on the San Antonio Manufacturing Inspection District Office’s ability to 
keep up with other work. I proposed to establish certain days of each week (i.e. Tuesday 
& Wednesday) where FAA inspectors would be at Eclipse, Anything Eclipse had ready 
on those days would be FAA inspected, and anything not ready would be inspected the 
following week. My proposal was not accepted, and I was directed to have FAA 
inspectors available at Eclipse to support their schedule, which pretty much meant seven 
days a week. It should be, noted here that Rotorcraft Directorate management became 
concerned about FAA inspectors becoming fatigued. Rotorcraft Directorate management 
thus directed that FAA inspectors would not work or travel on weekends. This decision 
was reversed however, and FAA inspectors were instructed to support Eclipse as 
necessary, including weekends. 

With the departure of the assigned FAA Program Manager from the Eclipse project, 1 
realized that I needed to assign one of the San Antonio Manufacturing Inspection District 
Office inspectors to serve as the Principal Inspector, FAA inspectors are typically 
assigned to serve as the Principal Inspector of several aviation manufacturing companies. 
Principal Inspectors typically conduct all necessary FAA oversight at the companies 
assigned them. The Eclipse project required too much FAA involvement however for 

NOTE: Shaded text reflects the oral summary portion of the statement. 
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Statement of Ford J Lauer III, Supervisory Aviation Safety Inspector/Manager, San 
Antonio Manufacturing Inspection District Office, Rotorcraft Directorate. 

Given before the U.S. House of Representatives Committee on Transportation and 
Infrastructure’s Subcommittee on Aviation on September 17, 2008: 

any one FAA inspector to be able to keep up with. I assigned several FAA inspectors to 
assist the Principal Inspector in carrying out the required tasks. 

The first production airplane was issued a standard airworthiness certificate by me at the 
end of December 2006, after some two months of ongoing inspection, rework by Eclipse, 
and re-inspection, as well as ongoing functional test procedure witnessing, rework by 
Eclipse, and re-witnessing, until all nonconformances were resolved and it was found that 
the airplane conformed to the type certificate and was in condition for safe operation. 
During my visits, I spent a great deal of time providing assistance and advice to Eclipse 
Inspectors on how they could bolster the quality system to ensure airplane inspection 
status. I let the Eclipse inspectors know what I had seen work in other companies. On 
individual levels the Eclipse inspectors seemed interested in what I was showing them. 
However, I never saw any of my recommendations or suggestions tried or implemented. 



NOTE: Shaded text reflects the oral summary portion of the statement. 
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Statement of Ford J Lauer III, Supervisoiy Aviation Safety Inspector/Manager, San 
Antonio Manufacturing Inspection District Office, Rotorcraft Directorate. 

Given before the U.S. House of Representatives Committee on Transportation and 
Infrastructure’s Subcommittee on Aviation on September 17, 2008: 




investigation notification was sent to Eclipse in early February, requesting any statements 
they cared to make. Additionally, Eclipse was notified that they should accomplish 
thorough re-inspection of the airplane to determine its true conformity status. Eclipse 
responded to the investigation notification in writing and stated that they internally 
investigated and could find no evidence of violations or any unsafe condition with the 
aircraft. Eclipse management had taken exception to both the investigation and the 
communication that the airplane should be re-inspected, and elected to take those matters 
to a higher level of FAA management. Application for FAA airworthiness certification 
of an aircraft must be accomplished by the applicant submitting FAA Forms 8130-6, 
Application for Airworthiness Certificate, and 8 1 30-9, Statement of Conformity. The 
Eclipse submitted FAA Form 8130-6 contained the certifying statement — "I hereby 
certify... the aircraft has been inspected and is airworthy and eligible for the 
airworthiness certificate requested. ” The Eclipse submitted FAA Form 8130-9 

NOTE: Shaded text reflects the oral summary portion of the statement 
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Statement of Ford J Lauer III, Supervisory Aviation Safety Inspector/Manager, San 
Antonio Manufacturing Inspection District Office, Rotorcraft Directorate. 

Given before the U.S. House of Representatives Committee on Transportation and 
Infrastructure’s Subcommittee on Aviation on September 17, 2008: 

contained the certifying statement — “The aircraft described above, produced under type 
certificate only,., conforms to its type certificate, is in a condition for safe operation, and 
was flight checked on 1-30-2007. ” Upon inspection, the FAA inspector found that the 
airplane pitot static functional test procedure failed; the airplane weight and balance 
report contained numerous errors; unqualified parts tags found on installed AHORS 
units; rtumerous improperly installed HiLok and Huck fasteners; production flight test not 
signed off in airplane log; and the keyboard for pilot data entry was labeled 
“EXPERIMENTAL ONLY.” Both flap actuators were found identified as 
“EXPERIMENTAL ONLY” as well as several other numerous other nonconforming 
characteristics. Title 14 Code of Federal Regulations part 21, section 21.2 states that “No 
person shall make or cause to be made (1) any fraudulent or intentionally false statement 
on any application for a certificate or approval under this part; (2) Any fraudulent or 
intentionally false statement in any record or report that is required to be kept, made, or 
used to show compliance with any requirement for the issuance or the exercise of the 
privileges of any certificate... " FAA Order 2150.3A (in effect at the time), paragraph 
202 .f. required that “every apparent or alleged violation must be investigated and 
appropriately addressed. ” Paragraph 202.e. required that “when an investigation is 
warranted, it should be conducted promptly. " Paragraph 900.a. established that “the EIR 
is the means for documenting, assembling, organizing, and presenting all evidence and 
other pertinent information obtained during an investigation. " 

NOTE: Shaded text reflects the oral summary portion of the statement 
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Statement of Ford J Lauer III, Supervisory Aviation Safety Inspector/Manager, San 
Antonio Manufacturing Inspection District Office, Rotorcraft Directorate. 

Given before the U.S.- House of Representatives Committee on Transportation and 
Infrastructure’s Subcommittee on Aviation on September 17, 2008: 


In February a District Office Audit was accomplished, prior to preparation for the 
Production Certification Board Audit. FAA policy (FAA Order 8120.2) requires both a 
District Office Audit and Production Certification Board Audit prior to issuance of an 
FAA Production Certificate. The District Office Audit was a thorough evaluation of the 
Eclipse airplane production quality control system. During the District Office Audit, 
over one hundred discrepancies were documented and consolidated into forty-two 
separate noncompliances. A notification of results was sent to Eclipse so that they could 
implement corrective action. The San Antonio Manufacturing Inspection District Office 
did not accomplish any follow-up to the District Office Audit. The Eclipse project was 
reassigned to the Fort Worth Manufacturing Inspection District Office in the late March- 
April timeframe, so all District Office Audit follow-up was accomplished by that office. 
It should be noted that there were two previous attempts at accomplishing a District 
Office Audit, the first being in approximately July of 2006. Not all areas of the Eclipse 
quality control system were evaluated. There was also a problem in that issuance of the 
type certificate had to be postponed, which affected the District Office Audit. 
Additionally, most of the areas of the Eclipse quality control system that were evaluated 
were relocated by Eclipse to other facilities after being evaluated. In approximately 
October of 2006 a second attempt at a District Office Audit was attempted. I was not 


NOTE: Shaded text reflects the oral summary portion of the statement 
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Statement of Ford J Lauer III, Supervisory Aviation Safety Inspector/Manager, San 
Antonio Manufacturing Inspection District Office, Rotorcraft Directorate. 

Given before the U.S. House of Representatives Committee on Transportation and 
Infrastructure’s Subcommittee on Aviation on September 17, 2008: 


personally involved, but was informed that virtually nothing was audited due to the team 
having to focus on inspection of Eclipse airplanes. 



assigned Senior Advisor brought in two assistants from outside the Rotorcraft 
Directorate. In emails from an assistant to the Senior Advisor, I was informed that the 
investigation case was wrong because Eclipse’s nonconforming airplane could not result 
in a violation of 14 CFR part 21, section 21.2. I discussed the matter with FAA legal at 
the FAA Fort Worth Regional Office and was told that the investigation was indeed 
proper. I described the entire investigation case in detail in a report I assembled, entitled 
Sequence of Events, Enforcement Case Number 2007SW430002, Eclipse Aviation 
Corporation. 


NOTE: Shaded text reflects the oral summary portion of the statement. 
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Statement of Ford J Lauer in. Supervisory Aviation Safety Inspector/Manager, San 
Antonio Manufacturing Inspection District Office, Rotorcraft Directorate. 

Given before the U.S. Honse of Representatives Committee on Transportation and 
Infrastructure’s Subcommittee on Aviation on September 17, 2008: 



Ihe Project Specific Certification 
Plan mentioned was revision “A” and was signed on March 15, 2007. It is my 
understanding that it has been revised several times since then. It should be noted here 
that FAA policy (FAA order 8130.2) establishes that the FAA has full responsibility for 
ensuring that aircraft manufactured without a production approval conform to their 
design and are in condition for safe operation. Up to the time the Project Specific 
Certification Plan was implemented, the Eclipse inspectors and FAA designees had not 
yet demonstrated that they were reliable in signing off airplane inspections and functional 
test procedures. 1 have never encountered, nor have 1 ever heard of, any working 
agreement, project specific certification plan, or situation other than the Eclipse project, 


NOTE: Shaded text reflects the oral summary portion of the statement. 
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Statement of Ford J Lauer HI, Supervisory Aviation Safety Inspector/Manager, San 
Antonio Manufacturing Inspection District Office, Rotorcraft Directorate. 

Given before the U.S. House of Representatives Committee on Transportation and 
Infrastructure’s Subcommittee on Aviation on September 17, 2008: 


where limits were placed upon the ability of FA A inspectors to thoroughly inspect 
aircraft. 



My decision was driven by all of the events I had experienced and observed in 
connection with the Eclipse project up to this point. 


In March, the FAA Principal Inspector, while at the Eclipse facility, informed me that an 
FAA designee at Eclipse had issued an experimental airworthiness certificate without 
having obtained the required authorization from the San Antonio Manufacturing 
Inspection District Office. Additionally, the Principal Inspector informed me that the 
FAA designee did not possess the appropriate designee function code to be able to issue 
the airworthiness certificate, so could not have received such authorization anyway. The 
Principal Inspector communicated with the former Program Manager in the Rotorcraft 
Directorate Manufacturing Inspection Office to ask what the process was for revoking an 
airworthiness certificate. The former Program Manager replied with the requested 
information. I was informed later through informal communication that the Principal 
Inspector allegedly took it upon himself to take possession of the airworthiness 
certificate, but that he later gave it back. No formal complaint was brought to me 
concerning the alleged incident. I did however counsel the Principal Inspector as well as 

NOTE: Shaded text reflects the oral summary portion of the statement. 
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Statement of Ford J Lauer III, Supervisory Aviation Safety Inspector/Manager, San 
Antonio Manufacturing Inspection District Office, Rotorcraft Directorate. 

Given before the IT.S. House of Representatives Committee on Transportation and 
Infrastructure’s Subcommittee on Aviation on September 17, 200S: 

ensured that all FAA inspectors at the San Antonio Manufacturing Inspection District 
Office were made aware of the requirements for pursuing revocation of an airworthiness 
certificate. 

In mid to late March I was informed by the Manager of the Rotorcraft Directorate 
Manufacturing Inspection Office that the Fort Worth Manufacturing Inspection District 
Office would assume responsibility for the Eclipse project. Involvement of the San 
Antonio Manufacturing Inspection District Office in the Eclipse project thus ended. Two 
FAA inspectors from the San Antonio Manufacturing Inspection District Office were 
utilized by the Fort Worth Manufacturing Inspection District Office for a few more 
weeks to ensure a smooth transition. 



As a veteran of United States military service, I know the meaning of integrity, loyalty, 
and dedication. In the military I lived by those words, and as an FAA employee and 

NOTE: Shaded text reflects the oral summary portion of the statement. 
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Statement of Ford J Lauer III, Supervisory Aviation Safety Inspector/Manager, San 
Antonio Manufacturing Inspection District Office, Rotorcraft Directorate. 

Given before the U.S. House of Representatives Committee on Transportation and 
Infrastructure’s Subcommittee on Aviation on September 17, 2008: 


public servant, I continue to live by them. I have been with the FAA since 1997, having 
served in the New Cumberland Manufacturing Inspection District Office in Harrisburg, 
Permsylvania and the Oklahoma City Manufacturing Inspection District Office in 
Oklahoma City, Oklahoma. I feel confident that the personnel of those offices will 
provide positive testimony as to my integrity, loyalty, and dedication. 


This statement was assembled based on the history of events as I remember them. 
Additionally, I obtained some information from archived electronic correspondence and 
official FAA records. 


NOTE: Shaded text reflects the oral summary portion of the statement. 
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STATEMENT OF NICHOLAS A. SABATINI, ASSOCIATE ADMINISTRATOR FOR 
SAFETY, AND JOHN J. HICKEY, DIRECTOR OF THE AIRCRAFT 
CERTIFICATION SERVICE, ON “FAA AIRCRAFT CERTIFICATION; ALLEGED 
REGULATORY LAPSES IN THE CERTIFICATION AND MANUFACTURE OF THE 
ECLIPSE EA-500,” BEFORE THE HOUSE COMMITTEE ON TRANSPORTATION 
AND INFRASTRUCTURE, SUBCOMMITTEE ON AVIATION, SEPTEMBER 17, 
2008. 


Chairman Costello, Congressman Petri, Members of the Subcommittee: 

I appear before you today to discuss the procedures, policies and decisions leading to the 
certification of the Eclipse EA-500 (Eclipse aircraft), a very light jet (VLJ) that received 
Federal Aviation Administration (FAA) certification on September 30, 2006. There have 
been numerous assertions by heretofore unnamed sources that the certification of this 
aircraft was rushed, achieved despite it not meeting appropriate standards, and 
accomplished due to extreme pressure placed on the FAA employees responsible for 
certification. While I am prepared to discuss the details of the Eclipse certification, I 
must state unequivocally at the outset what goes without saying: that FAA professionals 
would never and, in this case, did not, certify an aircraft that they knew to be unsafe or 
one that did not meet standards. I am unaware of any FAA safety professional who 
would choose to put the safety of the flying public at risk by certifying an unsafe product 
for introduction to the NAS. Signing his or her name to the certification of an aircraft or 
component only if it meets detailed technical standards is fundamenttd to the continued 
safety of the national airspace system (NAS). 

Because of the growing interest and alleged skepticism about the airworthiness of the 
Eclipse aircraft, I assembled a team of experts to review data compiled in connection 
with the certification of the aircraft, a Special Certification Review team (SCR). I felt it 
was important to have the SCR headed by a highly respected individual whose personal 
and professional integrity are above question. That’s why I was so pleased when Jerry 
Mack, a former Boeing executive who has extensive certification experience from the 
manufacturer’s perspective, agreed to head the team. The charter of the SCR directed 
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them to conduct an independent analysis and evaluation of the aspects of the type 
certification of the Eclipse aircraft that we understood were the subject of concern. All of 
them are highly respected professionals with technical expertise in different areas critical 
to type certification. 

The job of the review team was not an easy one but everyone pulled together and 
dedicated themselves, traveling around the country to meet with the key people and 
review the voluminous documents involved. Last Friday, the SCR announced its 
findings. The team’s bottom line was critical: FAA’s certification of the Eclipse aircraft 
was appropriate because it did meet the required standards. In addition, the team did not 
find any unsafe condition needing immediate attention. This is good news-that, in the 
opinion of some of the best technical experts in this country, the Eclipse aircraft meets 
the required standards and was, therefore, legally entitled to receive certification. Their 
report will be available to the Committee for your review. 

But also important to me and my team was learning of the deficiencies the SCR identified 
with regard to communication within the certification team and with regard to the 
documentation of decisions, I take seriously the criticism that the teams we assigned to 
this project did not communicate well with one another or with Eclipse. We fully accept 
the SCR’s criticisms of the process and agree that changes need to be made. I believe 
that if our type certification team had documented its various concerns in issue papers, as 
required, and had followed that process to resolution, all FAA staff involved in the 
project would have better understood and accepted the certification approach that was 
used in this project. I assure you that we will take every opportunity to improve 
communication at all levels of oiu organization and to ensure that our staff are 
accountable and follow national processes to appropriately document certification 
decisions. 


The Certification Process: An Overview 

One of the challenges of this hearing is that the FAA’s aircraft certification process is 
highly complex and technical. It is an extremely dynamic process, which means that no 
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two certifications are identical. Fundamental to any certification is to have FAA staff and 
the Applicant working closely together to establish general timelines and expectations, 
and to identify deliverables. The specifics of how the project should proceed are detailed 
in two planning documents, the Partnership for Safety Plan (PSP) and the Project Specific 
Certification Plan (PSCP). In these documents, the FAA and the Applicant agree to 
operating practices for a certification project. Each phase of the project is built on early 
mutual awareness of key certification issues, commitment to planning and managing the 
project, early identification and resolution of issues, and other elements to achieve the 
vision of the project. All phases of the project are designed to contribute to improving 
safety and assisting with the mitigation of cost and project risk. It’s an extremely 
interactive process with both FAA staff and the Applicant agreeing to specific goals and 
responsibilities. 

During type certification the FAA determines whether the design of the aircraft meets all 
the applicable regulatory requirements. At this stage, the approval is of the type design, 
not subsequently produced aircraft (approval of which is authorized under a production 
certificate, described below). FAA regulations specify the safety requirements, but the 
Applicant is fi’ee to propose the method they will use to demonstrate compliance. In the 
type certification process, it is the normal and preferred method for an Applicant to 
propose methods of compliance and then document such methods in their certification 
plans. Most fi-equently, the Applicant will use the methods of compliance published in 
FAA general guidance material, because they are known to be acceptable and the results 
are more predictable. Flowever, it is important to understand that while the regulatory 
requirements are mandatory, the specific methods of compliance are not. 

It is also important to understand that the law requires the Applicant to achieve defined, 
minimum standards. If those standards are met, the Applicant is legally entitled to a type 
certificate.’ Do not mistake the term “minimum standards” for “minimal standards.” It is 
unworkable to require anything other than the “minimum standards” prescribed in the 
regulations in order for the Applicant to know exactly what it has to demonstrate. 

' 14 C.F.R. §21.21. 
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Moreover, the FAA is required by law to establish clear regulations for these applicants 
to follow,^ and is likewise obligated not to act arbitrarily or capriciously? For an FAA 
professional to require something other than what is outlined in the regulations is not only 
inappropriate, it is illegal. 

Once an Applicant receives its type certificate, it has six months to obtain a production 
certificate or an approved production inspection system. The production certificate is 
issued when the Applicant demonstrates that it can reliably reproduce aircraft that meet 
the approved type design.'* Obtaining a production certificate is extremely challenging 
for a new company entering the industry because they must establish the physical and 
procedural infrastructure to develop the capability to consistently reproduce aircraft that 
conforms to the type certificate. Until a production certificate is issued, the FAA must 
inspect each aircraft the Applicant produces as it is being built in order for us to ensure 
that the aircraft meets the approved type design. This is why we require that the 
Applicant obtain the production certificate within six months of the type certificate. FAA 
cannot indefinitely dedicate resources to inspect every aspect of every aircraft built by the 
Applicant. 

In addition, an FAA Flight Standardization Board (FSB), composed of FAA pilots and 
other experts in flight operations, usually begins work near the end of the Type 
Certificate activities and is required to address any unique aspects of a new airplane. It 
determines operational suitability of the aircraft and its systems, requirements for flight 
crew training aids, type rating requirements for pilots, and any unique or special training 
requirements. These are determined through flight tests, meetings with the Applicant, 
review of documents, etc. Setting these standards and demanding that the Applicant 
meets them are regulatory obligations of the FAA.^ The FSB also determines emergency 
evacuation capability, the resolution of flight standards issues, and other tasks as 
appropriate. The Board’s membership includes operations inspectors from FAA district 


^SU.S.C. §§551etseq. 

’ See, e.g., National Ass'n of Home Builders v. Defenders of Wildlife, 127 S. Ct. 2518 (2007). 
"14 C.F.R, §21.135. 

’ 14C.F.R.Parts91, 121, 135. 
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field offices or representatives fi'om the FAA headquarters as appropriate, a board 
chairperson from the FAA’s Airplane Evaluation Group (AEG), and an alternate 
chairperson. While the FSB evaluation is not part of the certification process of the 
physical aircraft, it is an essential part of the evaluation of the aircraft because it 
determines how the aircraft may be operated. 

We cannot stress enough that this brief description of FAA’s certification of an 
Applicant’s product is an extreme oversimplification of the complexity and pressures 
associated with the process. In turning to the specifics of the Eclipse certification, more 
of those complexities and pressures will become apparent. While the Eclipse 
certification process was fairly typical in terms of encountering those complexities and 
pressures, it was xmusual in some other respects. The Eclipse certification process 
involved an Applicant that had never before attempted to obtain FAA certification of its 
product. The process also involved an FAA field office that — though very competent in 
certifying aircraft products — ^had never before been responsible for a high profile, highly 
anticipated product. This situation resulted in FAA headquarters carefully monitoring 
both the type and production certification of the Eclipse aircraft. 

During the process, some differences of opinion or questions of regulatory policy that 
arose during the Eclipse certification were raised to FAA headquarters level for 
resolution. In this instance, I believe raising the conflicts or questions to headquarters 
was the appropriate and right thing to do. This Committee has been justifiably critical of 
the FAA when headquarters failed to step in when problematic issues arose in the FAA 
regional and district offices. This is a case where headquarters management properly 
intervened to support and guide our field staff in working through problems that arose. 

Type Certification Issues 

Some of the problems that were a focus of concern during the type certification process 
involved the aircraft flaps, stall warnings, screens blanking, and most significantly, how 
and whether the avionics should have been approved. As I briefly review each of these 
issues and why I believed they were properly addressed, I would ask that you focus on 
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the standard that had to be met and remember that if the standard was met, the law 
requires FAA to issue the certificate. 

For an aircraft to fly safely, it is important that the flaps on the wings operate properly. 
Consequently, there is a certification requirement that the aircraft have a system to 
prevent the flaps fi'om moving to an unsafe, as)Tmnetrical position. This problem was 
recorded only once during certification. However, test pilots did cite a more frequent 
problem of receiving flap failure messages. Most flap failure messages were caused by 
system errors. The problem identified by the test pilots was mitigated by improving the 
flight manual procedures to assure operational safety. The problem experienced by the 
pilots was not the result of the certification standard not being met. 

A second area of concern involved what were viewed as too fi'equent stall warnings 
experienced by FAA pilots. The dialogue on this issue has often been referred to as 
“false stall warnings,” which is very misleading. The certification requirement is that the 
warning system activate as the aircraft approaches the stall speed. During testing, the 
stall warning system activated appropriately. There were no “false warnings.” What was 
ultimately determined was that the maneuvering speeds and abnormal flap landing 
approach speeds that the manufacturer provided to the FAA pilots in the flight training 
manual and the airplane flight manual, respectively, were slower than they should have 
been. Consequently, operating at those speeds meant the FAA pilots were flying closer 
to the stall speed than they should have been, thus resulting in a more fi-equent activation 
of the warning system than pilots expected. The pilots assumed the stall warning system 
was activating inappropriately and referred to the activation as false warnings. The fact 
was that the system worked properly, but some of the speeds the pilots relied on were 
inaccurate and, ultimately, changed by the manufacturer. Again, the certification 
standard, that the stall warning system notify the pilot that he or she was approaching 
stall speed, was met. The training manual and flight manual speeds were changed before 
the first airplane was ever delivered to a customer. 
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The next area we reviewed was blanking of the screens of the Electronic Flight 
Information System (EFIS). The EFIS provides many required controls and displays for 
the pilot. It consists of two Primary Flight Displays, a Multifunction Display, an 
Autopilot Control Panel, a Center Switch Panel, and a keyboard. There were a total of 
three screens on the control panel. Although there were times when a screen blanked out, 
the bottom line is that never more than one screen blanked out at any given time. The 
required standard is that one display of information, essential for continued safe flight, be 
available to the crew. In the case of Eclipse, the pilot always had the requisite 
information available to continue safe flight. Consequently, the required standard was 
met. 

Finally, and perhaps most importantly, were the allegations that a portion of the aircraft’s 
avionics system was certified to less than the applicable standards. I say that this is 
perhaps the most significant area of concern during the certification process because it is 
this issue that ultimately resulted in the Director of the Aircraft Certification Service, 
John Hickey, getting involved in the type certification. 

Fundamental to understanding this matter is to understand how the FAA certifies 
avionics. The manufacturer of any avioitics component can apply to the FAA for a 
Technical Standard Order Authorization (TSOA). A TSOA allows a component 
manufacturer to certify its product for a broader use — i.e. to enable it to sell its product to 
a range of aircraft manufacturers, not just to Eclipse who was applying for the type 
certificate in this case. A TSOA is not required to obtain a type certificate. In this case, 
Avidyne, the avionics manufacturer received its TSOA after Eclipse received its type 
certification. When an airplane is certified and contains components without TSOAs, the 
aircraft manufacturer becomes responsible for the component, both in the design and in 
the production. 


During the Eclipse certification, as the negotiated target date for the issuance of Eclipse’s 
type certification came closer, it became clear that Avidyne, the manufacturer of the 
aviottics system, would not qualify for a TSOA by the target date. In order not to delay 
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the timely issuance of the type certificate, Avidyne and Eclipse decided to have the 
avionics certified as part of Eclipse’s type certification, while Avidyne continued its 
separate, parallel work on getting its TSOA. The FAA could certify that the Avidyne 
product met standards on the Eclipse aircraft, without making the determination that it 
met requirements for a TSOA. This certification approach is common for components of 
an aircraft. 

Because of the change in approach, a disagreement arose between Eclipse personnel and 
our staff in our Aircraft Certification Office (ACO). Specifically, the issue centered 
around a dispute as to what actions were necessary to achieve compliance with the 
standards. To receive TSOA approval for certain types of software-driven avionics such 
as the one Avidyne was developing, an applicant is explicitly required to demonstrate 
satisfactory completion of the industry standard, referred to as “DO-178B. However, to 
receive a type certificate, there is no explicit requirement to meet DO-178B. In fact, the 
regulation governing this lists multiple ways to meet the requirements.® Consequently, 
Eclipse submitted a plan to meet the type certification requirements through a 
combination of ground tests, flight tests, laboratory tests, and other activities. 

It was the belief of the ACO staff that Eclipse needed to complete DO- 1 78B testing 
anyway in order to achieve the type certification, and informed Eclipse of that 
requirement. Eclipse officials notified FAA headquarters officials that they considered 
the ACO’s requirement to meet DO-178B to be incorrect when seeking a type 
certification. Rather, Eclipse argued, the type certification standards allowed for its 
proposed plan for compliance. 

John Hickey was concerned that FAA policies and procedures were not being followed 
and traveled to Albuquerque, accompanied by the headquarters officials tasked with 
ensuring the development and implementation of national certification policy. John and 
these headquarters staff met with the FAA certification team to discuss whether the 


‘ 14 C.F.R. §21.305. 
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appropriate standards were being required, given the request that the component be 
evaluated only as part of the Eclipse type certification. 

I support John’s decision to elevate this matter by bringing in the headquarters 
certification policy staff. As I mentioned, this was a situation where there was an FAA 
field office that had not previously been responsible for the certification of a high profile, 
complex project and an Applicant that had never been through the certification process. 
The change in Eclipse’s compliance strategy came relatively late in the program and left 
little time for the FAA to develop a response strategy. It was entirely appropriate that 
headquarters evaluate the differences of opinion about how the matter should proceed. In 
the end, John left it to the headquarters policy officials to determine whether the Eclipse 
proposal that Avidyne’s product had already met the requisite standards for type 
certification, vras appropriate. They ultimately agreed with the Eclipse position. 

I realize that this decision created resentment and raised questions for some people. No 
one likes to be second guessed or overruled. I know that. It takes a strong manager to 
intervene in a process when he knows his input will be unpopular. But making difficult 
decisions that are the right decisions is what leadership is all about. 

As a final comment on the issuance of the type certificate, much has been made of the 
fact that the certificate was signed on a Saturday. I want to reiterate the complexity and 
pressure involved in the certification process. High profile projects always involve a 
strong and dedicated push at the end to meet the negotiated deadline, if possible. The 
pressure is always to reach a decision. It is never to reach a particular outcome. The 
deadline is always negotiated for a reason. The Applicant needs to know whether it can 
be certified by that date — ^in this case, September 30, 2006-for its own business reasons. 
The FAA has agreed to provide the resources necessary to assist the Applicant and do the 
necessary evaluations by the target date. It is a shared goal. If FAA agreed to a date that 
fell on a Saturday, then it was because the office believed the goal could be met by that 
date. Certification on that date, regardless of the day of the week, should not receive 
undue attention. 
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Production Certificate Issues 

Turning to the production certificate. Eclipse had six months from receiving its type 
certificate, or imtil the end of March 2007, to obtain its production certificate or an 
approved production inspection system. Until it received a production certificate, Eclipse 
could only produce airplanes with very close FAA supervision of its production system 
and of the inspection and airworthiness certification of each airplane produced. Once 
again, the deadline created pressure for those individuals working on this stage of the 
process. 

Eclipse faced some challenges during this phase. The first Eclipse airplane was delivered 
to a customer at the end of December 2006. Subsequently, Eclipse fell behind in its 
delivery schedule and was tmable to deliver airplanes to customers as promised. This 
may have been attributable to a number of factors, including that the company suffered 
from firequent changes in key personnel and an overall lack of awareness of aircraft 
production best practices. The company was fiustrated that its production schedule was 
in disarray and believed FAA was part of the problem. FAA employees were fiustrated 
at Eclipse’s inability to consistently reproduce a product that met the approved design 
standard, thus requiring continued heightened FAA supervision of the production 
process. 

All the while, the March 30’*' deadline for production certification loomed large. The 
increasing pressures on both sides resulted in a degradation of the personal and 
professional relationships necessary to achieve success and led to a number of 
unprofessional encounters that once more came to the attention of headquarters and John 
Hickey. There were allegations by Eclipse that the standards being applied were 
inappropriate and allegations by FAA staff that the regulations were not being followed. 


With this backdrop, in early March, John established an independent team to oversee 
completion of the production certificate and, in the interim, the airworthiness certification 
of individual airplanes. The team was made up of highly respected FAA professionals 
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from across the country and led by Ron Wojnar, who is a senior advisor in the Flight 
Standards Service. The independent team found that some FAA policy and procedures 
for airworthiness and production certification were not being followed, and that there was 
no effective FAA management plan in place to provide a roadmap for the parties to 
understand how to achieve a production certificate in the requisite time. 

Consequently, the first action directed by the team was to jointly develop and implement 
a revised, more detailed PSCP, one of the planning documents I described earlier. This 
management tool defines the roles, responsibilities and expectations for both the FAA 
and the Applicant in order to meet the desired milestones and ensure compliance with 
regulations and policies. It does not change any regulatory requirements. It just provides 
specific steps for how to meet those requirements taking into consideration FAA’s past 
experience with the Applicant and our knowledge of best practices. In this instance, it 
amplified a less detailed plan that had previously been developed. 

As a result of the PSCP and weekly meetings or telephone conferences to hold everyone 
accountable for meeting the PSCP goals, the production certificate was issued on April 
26, 2007. (The FAA granted Eclipse an extension of the six-month deadline for issuing 
the production certificate on March 29, 2007, as permitted by the regulation.’) A total of 
1 1 Eclipse aircraft had been delivered prior to the issuance of the production certificate, 
with the FAA inspecting and certifying each individual airplane. 

During the production certification process, two FAA professionals were removed from 
the production certification team, at the direction of the FAA Manager of the local 
Manufacturing Inspection Office. Their removal was endorsed by Ron Wojnar, the head 
of the independent team. The management officials concluded that these FAA 
professionals were frustrated with their interaction with their Eclipse counterparts. 
Understandably, their frustration may have led to a lack of objectivity — a factor that FAA 
management appropriately considered. 


’ 14 C.F.R. §21.123. 
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Once again, a headquarters action resulted in some local FAA officials being challenged 
about the way they had conducted the production certification process. Once again, it is 
understandable that those individuals, whose judgments and decisions were questioned, 
would be offended. And, once again, our leadership and the difficult decisions we’ve 
made have been challenged as inappropriately deferential to the Applicant. But the fact 
is that we sent in the best and the brightest to ensure the most appropriate outcome based 
on the legal requirements. That additional review by FAA should be commended and not 
condemned. The attention and interest of FAA headquarters staff should not be viewed 
as inappropriate. It should be viewed as a government doing its job to make the system 
safer and working to introduce ever safer products into the NAS. 

Flight Standardization Board Issues 

As the production certificate team was performing its duties, FAA’s Flight Standards 
Service began its review with the FSB. The FSB team is required to evaluate the 
manufacturer’s training programs, aircraft manuals, checklists, aircraft system 
performance, and equipment functionality to determine the aircraft’s suitability, training 
and flight checking requirements, and crew configuration for operation in accordance 
with FAA regulations. Because of the aircraft’s design and performance, the FSB was 
also required to determine the pilot type rating for the aircraft. Eclipse requested that the 
aircraft be certified for Single Pilot Instrument Flight Rules (SIFR) operations, and the 
FSB evaluated the aircraft in accordance with these standards. 

For a new airplane requiring a type rating imder FAA regulations,® the FSB uses the 
broad guidance specified in FAA Advisory Circular 120-53, for a type rating 
determination and to evaluate the manufacturer’s training program for a new aircraft. 
Additionally, FSB pilots/safety inspectors are required to complete the training program 
and operate the airplane to the standards required by the Airline Transport Pilot/Type 
Rating Practical Test Standards, and in accordance with the Airplane Flight Manual 
normal, abnormal, and emergency procedures and operating limitations. When it 
becomes difficult for the majority of FSB pilots to complete the manufacturer’s training 

®14 C.F.R, §61.31. 
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program and be able to operate the airplane at the required standards, an aircraft’s 
training program could be deficient, its operational workload could be too high for the 
average pilot, or it could be a combination of both. If the FSB determines that the 
workload is too high, it will not issue a t)^® rating for a single pilot. 

The FSB met at the Applicant’s headquarters on September 23, 2006 and adjourned on 
October 6, 2006 without issuing a type rating for the operation of the aircraft. During this 
evaluation period or “Phase I,” the FSB found munerous problems with the aircraft, 
including screen blanking of the flight displays, nuisance stall warnings, flap failures, 
unavailable autopilot functions necessary for SIFR operations, etc. Because these issues 
led to an extremely high cockpit workload during IFR operations, it would have 
necessitated two pilots to fly the aircraft. At that time, the FSB was unable to issue a 
single pilot type rating for this aircraft as requested by the Applicant, and made 
recommendations to Eclipse that the problems be resolved before presenting the aircraft 
for another FSB review. The FSB process worked - our team evaluated the product 
according to our standards, and when the product could not meet those standards, the 
FSB refused to issue the type rating. 

The FSB reconvened on December 6, 2006 (“Phase IF’), after Eclipse indicated that the 
Phase I problems had been addressed. While many of the 1 5 original issues had been 
resolved, some were still outstanding. Additionally, the FSB found three other issues that 
needed resolution before a type rating could be issued. The FSB adjourned on December 
14, 2006. Once again, the standards were not compromised, our rules were followed, and 
the process worked. 

Finally, the FSB reconvened for a third evaluation (“Phase IIP’) in January 2007. The 
FSB found that most of the previous outstanding issues had been resolved, but identified 
four issues with the aircraft, some of which had previously occurred. Once again, the 
team required the Applicant to take corrective measures in order to bring the aircraft in 
compliance with the standards for a SIFR operations t 3 q)e rating. Eclipse did resolve all 


13 



211 


the problems during Phase III, and the FSB issued the SIFR operations type rating on 
January 26, 2007. 

During and after every phase of the FSB’s evaluations, all the problems that came to light 
were briefed fully to Eclipse staff and management for them to address and resolve. A 
number of them were resolved while the FSB was present; others were resolved during 
the time between the phases. Management in both the Aircraft Certification Service and 
the Flight Standards Service were also informed of the issues. 

In short, the FSB process worked exactly as it should have. The Applicant presented 
their aircraft to the FSB for evaluation and a type rating determination. The FSB tested 
the aircraft and found it lacking in certain respects. The team required that the Applicant 
resolve the problems before proceeding further, and the Applicant did. While it was an 
undoubtedly frustrating process on both sides, all the issues were in fact resolved, and the 
FSB, in accordance with the law and FAA policy, issued the appropriate SIFR type 
rating. 

Conclusion 

The certification of Eclipse was a challenging project. It is impossible to convey in a 
single overview the complexities and thousands and thousands of decisions that went into 
the aircraft’s certification. I know that this Committee understands the process is 
demanding one. Tough decisions were made and people were pushed to work hard. 
Could certain things have been done differently? Absolutely, but that would be the case 
with any lengthy, complicated process that receives this level of investigation and 
scrutiny after the fact. 

Our bottom line is that FAA has a vested safety interest in the certification of new 
aircraft. Each new generation of aircraft tends to be safer than the ones that preceded 
them. Our regulatory standards continue to raise the safety bar as new technologies are 
introduced. For this reason, FAA wants new airplane programs to succeed. But by 
succeed, I mean we want to help manufacturers meet all the regulatory requirements for 
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their product. But helping them succeed never means giving them a pass on regulatory 
safety requirements so they can meet delivery schedules. 

A good government is a government that is dedicated to its mission, accountable to the 
public and responsive to the needs of its citizens. I understand and appreciate that this 
Committee wants to ensure that responsiveness does not result in less than vigilant 
regulatory oversight. I am keenly aware of your concerns because they are my concerns 
as well. As always, you have my commitment to holding my organization and the 
industry we regulate to the highest aviation safety standards in the world. 

Mr. Chairman, this concludes my statement. I will be happy to answer your questions at 
this time. 
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FAA Aircraft Certification: Alleged Regulatory Lapses in the Certification and 
Manufacture of the Eclipse EA-SOO 

Questions for the Record 


Panel III 


The Committee is requesting a follow up to the questions listed below that were 
addressed at the hearing, but were not answered. 

1 . Mr. Wojnar, as you heard in the testimony and you are very much aware, the production 
certification was approved with 13 outstanding deficiencies as was identified by the 
Inspector General and it took a better part of the year after the approval was given to get 
these corrected with the aircraft still being built and placed into service. In retrospect, in the 
ftiture, would you do that differently? Would you issue the production certification for 
these outstanding issues to be addressed with an lOU, essentially awarding a production 
certification and allowing the manufacturer to go forward and, at a later date, correct or 
address these issues? Secondly, is this normal, appropriate, or in the best interests of the 
public? 

RESPONSE: 

There may be some confusion as to the 1 3 items referenced in the question. There are 
13 action items contained in the FAA/Eclipse Aviation Corporation (EAC or Eclipse) 
production certificate project specific certification plan (PC-PSCP). These are not 
“specific production problems” or “deficiencies,” and had no bearing on the issuance of 
the production certificate (PC) itself. The PC-PSCP was signed on June 6, 2007, about 
five weeks after the PC was issued. The PC-PSCP was a post production certificate, 
proactive approach, aimed at continuous improvement in communications, 
notifications, production approval holder (PAH) responsibilities, and accountability, to 
ensure all regulatory requirements were continually being met by Eclipse after the 
issuance of the PC. The PC was issued to Eclipse because they met the applicable 
requirements for PC issuance. These “13 items” included actions for both Eclipse and 
the FAA to follow-up on in the interest of continuous improvement. 

In February 2007, the FAA conducted a District Office Audit in preparation for the 
issuance of a PC at Eclipse. During the audit, 42 non-compliances were documented. 
All 42 items and corrective actions were evaluated and found acceptable by the FAA. 
Twenty-nine of the 42 were closed immediately. That left thirteen (13) non- 
compliances, which had follow-up actions to be completed. It is not unconunon to 
have non-compliances that take long term corrective actions to resolve and still meet 
the requirements to receive a PC. 

In both cases it is a normal process to document items for continued improvement, and 
agree on an action plan. 


1 



215 


2. Mr. Hickey, how many times has the FAA issued a certification on a Saturday afternoon? If 
this has occurred, as you indicated at the hearing, provide the Subcommittee with the 
aircraft make/model and the date of certification. 

Furthermore, couldn't that have happened on the following Monday, during a normal 
workweek? Why was it necessary for an inspector to come in on a Saturday to certify it? 

RESPONSE: 


The FAA has issued the following certificates on the weekend. Four certificates have 
been issued on a Saturday and four on a Sunday. 


TCand 

TCDS 

Number 

DATE 

Day of 

the 

week 

Make 

Model 

2H3 

December 10, 1960 

Saturday 

Bell helicopter 

47G-2A 

2A3 

July 25, 1965 

Sunday 

Mooney 

M20F 

A4SW 

September 3,1988 

Saturday 

Ayres Corporation 

S2R-T65 

A00006WI 

March 26, 1995 

Sunday 

Hafei Aviation 
Industry Co., Ltd. 
(Haic) 

Y12IV 

H6SO 

June 29, 1996 

Saturday 

Southwest Florida 
Aviation 

SW205A-1 

P43EA 

March 29, 1997 

Saturday 

Sensenich Wood 
Propeller Co 

W90T6JA 

2A3 

February 7, 1999 

Sunday 

Mooney 

M20S 

2A3 

October 1 5, 2006 

Sunday 

Mooney 

M20TN 


The FAA frequently works outside normal business hours during aircraft type 
certification programs. Federal Aviation Regulations (FARs) entitle an applicant to a 
type certificate when the FAA finds that the aircraft has met the applicable standards 
and has no unsafe feature or characteristic. Once the FAA has made these findings, 
there is no basis for waiting to issue the type certificate. 


2 




216 


NOTE: NO QUESTIONS NUMBERED 3 OR 4 WERE SUBMITTED. 
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5, Mr, Sabatini, there were 1 1 of these planes that Eclipse was permitted to deliver to their 
customers with the above-mentioned deficiencies and lOUs outstanding. What is the FAA's 
justification for allowing this to happen? 

RESPONSE: 


As noted in the response to Question 1, these “deficiencies” had no bearing on the 
issuance of the PC and would have no effect on aircraft delivered by Eclipse. 
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6. Mr. Sabatini, please provide a response to Mr. Oberstar's inquiry as indicated below in the 
transcript of the hearing: 

RESPONSE: 

See response to Question 7 below. 
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7. Mr. Sabatini, in April, we recommended that you amend the Customer Service Initiative to 
avoid the appearance of conflict-of-interest with your one and only safety mandate. This is 
another example of that appearance of conflict-of-interest. When do you expect to publish a 
new document in place of the current Customer Service Initiative? What steps are you 
taking to address this issue? 

RESPONSE: 


We have developed the Consistency and Standardization Initiative, which clearly states 
our commitment to the public. It sets out our expectations for the aviation community 
when they work with us and articulates our commitment to provide timely and 
complete responses in a respectful and professional manner. It is under final review 
within the FAA. 
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8. Mr, Sabatini, much of the IG's testimony focused on the manufacturing problems of the 
EA-500 that continue today. Your "Special Certification Review Team." apparently did not 
look at any of the issues related to the approval of the production certificate (PC), despite 
numerous problems identified by various FAA inspectors and engineers, and the PC was a 
major focus of the IG investigation. The IG testified that these manufacturing problems 
continue with the aircraft today. Have you gone back and conducted a review of the 
production process of the EA-500? If not, when will this take place? 

RESPONSE: 


The Special Certification Review (SCR) team was chartered to evaluate specific issues 
of compliance regarding the type certification of the Eclipse EA-500 because this was 
the initial area of review by the Office of the Inspector General, based on concerns 
raised by employees since the issuance of the type certificate. The SCR was to review 
and evaluate certain areas of the type certification and continued operational safety 
information to determine if the type design complies with 14 CFR Part 23 
requirements. The charter did not include a review of the production certification. 

With regard to the production certificate (PC), the FAA has provided oversight of 
Eclipse’s production approval for approximately a year and a half. There have been 
ongoing principal inspector and supplier control audits conducted by the Fort Worth 
Manufacturing Inspection District Office (MIDO) since issuing the PC. 

FAA Order 8100.7C, Aircraft Certification Systems Evaluation Program (ACSEP), 
outlines the process utilized to determine if FAA production approval holders (PAH), 
their priority parts suppliers, and delegated fecilities are complying with applicable 
regulations and the procedures established to meet these regulations. The ACSEP is an 
element of the Aircraft Certifications Service's Continued Operational Safety Process 
and evaluates the actual operating practices of a production approval holder and 
delegated facilities against the Code of Federal Regulations, FAA-approved data, and 
the facility's internal procedures. ACSEP evaluations are conducted at regular intervals 
for all PAHs. Shortly after the issuance of the Eclipse PC, an ACSEP audit was 
scheduled for September 2008. 

The ACSEP evaluation at Eclipse Aviation was conducted from September 23 through 
October 2, 2008, and consisted of eight team members. The ACSEP evaluation team 
identified no safety-related noncompliance. The team identified some areas for 
continued improvement in the quality system, and are working on an action plan with 
Eclipse. The issues observed during the ACSEP included examples of company 
employees not following company documented procedures and suppliers not following 
Eclipse procedures. The procedures associated with producing an airplane are 
extensive and complex; therefore it is common during an audit to find instances where 
a particular procedure is not being completely followed. The observations we made 
during the Eclipse ACSEP evaluation are typical of observations we find at other PC 
holders. 
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9. Mr. Sabatini, FAA inspectors found problems with Eclipse supplier-manufactured parts on 
26 of the 28 aircraft operated by the largest user of the EA-500. So my question is what 
have you done? What has the FAA done with die findings of those inspectors concerning 
the manufactured parts on 26 of those 28 planes? 

RESPONSE: 


We believe the Committee may be referring to service difficulty reports (SDRs) 
submitted on Eclipse EA-500 aircraft. Nearly all of these SDRs were submitted by the 
then-largest user of the EA-500 who operated 28 aircraft. We are answering this 
question based on the assumption that the Committee is referring to these SDRs. 

Service difficulties occur in all type certificated aircraft, and the reporting of them is an 
important source of data to the FAA. Reviewing SDRs and evaluating whether they 
indicate a safety issue is an important part of the Aircraft Certification Service mission. 
The responsible airplane certification office has been monitoring service reports on the 
EA-500 since the airplane first entered service. Some of the service reports we 
received on the Eclipse EA-500 resulted in the FAA issuing airworthiness directives 
(AD) on the pitot probe. The majority of SDRs reviewed did not constitute an unsafe 
condition warranting airworthiness directive action. 

In addition to the airplane certification office’s review of Eclipse SDRs, we also tasked 
the Special Certification Review (SCR) team to review SDRs on the Eclipse EA-500. 
The SCR team identified and reviewed a total of 85 SDRs pertaining to the Eclipse 500. 
Overall, the SCR team concluded the majority of the SDRs resulted Ifom reliability 
issues separate from compliance with the minimum FAA standards. Three of the SCR 
team’s recommendations were related to service issues and are presented below: 

Recommendation No. 3 

The FAA and Eclipse should conduct a root cause analysis of the operational 
trim and mistrim issues being reported in the field. 

Recommendation No. 4 

The FAA and Eclipse should conduct a root cause analysis of the trim actuator 
failures documented through the SDR system and other in-service reports. 

Recommendation No. S 

All cognizant FAA offices (ACO, MIDO, AEG, and CMO) should work 
together to establish appropriate corrective action for fire suppression bottle 
failure issues documented through the SDR system and other in-service reports. 

We value the SCR team’s recommendations and have accepted them. We have 
established a team that is developing an action plan to address the recommendations of 
the SCR team. 
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Questions NOT Addressed at the Hearing (09-17-2008) 

Please provide responses to the questions listed below. Although not asked at the 
hearing, the Committee requests that you provide an official answer to each question. 

10. You say that FAA met all pertinent certification regulations, but the Inspector General 
found that it is the totality of actions or inactions that raise strong reasons for concern. 
What is your reaction to that statement? 

RESPONSE: 


The FAA’s certification process and obligations are extremely complex. What may 
appear to some as a reason for concern may in fact be a minor issue; conversely, what 
may not concern some may be of great consequence to our aviation experts. The 
certification of Eclipse was a challenging project. While there were certainly 
challenges at each stage of the certification process, at every stage, the EA-500 was 
ultimately determined to meet the certification requirements given the data and 
information known at the time. Thus, while the “totality of actions or inactions” is 
cited as a reason for concern, in fact, the certification program, as evaluated by our 
experts was found to meet all of the applicable regulations. In doing so, the applicant 
was legally entitled to certification under the Federal Aviation Reflations. 
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1 1 . Why was Eclipse Aviation Authorized as an Organizational Designated Airworthiness 
Representative (ODAR)? Doesn’t a company need to have a history of demonstrated 
experience as a company in order to receive this designee status? How could Eclipse have 
been granted this with it being a completely new company 4 years prior to issuance of the 
TC? 

RESPONSE: 


To receive an ODAR, per FAA Order 8100.8, the applicant must be a Production 
Approval Holder or a non-PAH (i.e. Eclipse Aviation Company at the time of ODAR 
issuance) involved in a high probability of obtaining an FAA production certificate (PC) 
for a type certificate product. Eclipse demonstrated a need for an ODAR, based on the 
production plan for the airplane. 

Applications submitted by non-PAH organizations must show evidence of an ongoing 
type certification program and an established quality control system among other things. 
The ODAR applicant is required to meet all Designated Airworthiness Representative 
(DAR) qualifications for the functions they will perform by ensuring that the individual 
authorized representatives collectively meet the qualification criteria in FAA Order 
8100.8, Designee Management Handbook. New companies are able to meet the requisite 
qualification criteria by hiring professionals who gained their experience working for 
other aircraft companies. 

The Eclipse airworthiness representatives given ODAR authority had extensive industry 
quality assurance experience, including work at Raytheon and GE Aircraft Engines. Per 
FAA Order 8100.8, the FAA considers applicants’ total relevant experience, not just 
experience gained with the manufacturer seeking the ODAR. 
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12. It appears that FAA lays out approved methods for compliance, but in the case of Eclipse, 
used "work-arounds,” "alternative means of compliance," found reason for "equivalent 
levels of safety," etc. While these techniques are sometimes necessary, given evolving 
technology in aerospace, do you think such means can also be abused? 

RESPONSE: 


The terms “work-arounds,” “alternative means of compliance,” and “equivalent levels 
of safety” are terms that appear to be misunderstood. The FAA did not allow Eclipse to 
use an “alternate means of compliance” to meet design certification requirements. The 
term “alternate means of compliance” or “AMOC” has been mischaracterized as a way 
of showing compliance differently from the normal or established manner. To clarify: 
the term AMOC is typically associated with an Airworthiness Directive (AD). The AD 
is a regulatory requirement that defines “specific” actions to occur within a specific 
timefi-ame, to address an unsafe condition. In this sense, an AMOC is a means to use 
an “alternate” or different method from that defined in the AD, to correct the unsafe 
condition and comply with the AD. Compliance via an AMOC provides the same level 
of safety as compliance per the means outlined in the AD. 

There is nothing in the Federal Aviation Regulations (FARs) that permits the FAA to 
accept anything other than the approved level of safety compliance. The regulations 
allow options for applicants on how to comply with the requirements. Should an 
applicant choose to exercise one of the legally permitted options and meets the required 
level of safety, that applicant is entitled to receive certification of its product. Because 
applicants are still required to meet our safety standards, the FAA has no evidence that 
these legally permitted options are being abused. 

The FARs provide minimum airworthiness standards and typically do not specify a 
required means of complying with those standards. For many airworthiness standards, 
the FAA has defined an acceptable means of compliance in an advisory circular. 
Advisory circulars clearly state that they provide one means, but not the only means , of 
complying with the applicable standard(s). When an applicant chooses to use another 
means to demonstrate compliance per the regulations, it is not a “work-around.” 

Equivalent level of safety findings, which are provided for in 14 C.F.R. § 21.21, are 
made when literal compliance with a certification regulation cannot be shown and 
compensating factors exist which can be shown to provide an equivalent level of 
safety. Each finding includes a description of any design changes, limitations, or 
equipment imposed to make the finding of equivalency. An explanation of how the 
actions taken provide an equivalent level of safety to that intended by the regulation 
is also provided. 

It is important that applicants have the ability to demonstrate compliance with 
certification standards using a variety of methods. Such options facilitate the 
certification of new, innovative, safety-enhancing technology into aircraft designs. 
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In determining acceptable means of compliance and making equivalent level of safety 
findings, the FAA follows FAA Order 81 10.4C. The process for making an equivalent 
level of safety finding is rigorous and thorough, to assure that such findings are 
appropriate. The rigor of this process is one of the reasons we have not seen abuse in 
the use of equivalent level of safety findings. 
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13. Do you believe the FAA’s Customer Service Initiative CSll. which has been previously 
debated in our April 2008 Full Committee hearing, played a role here? 

RESPONSE: 


We appreciate that this Committee has strong feelings about FAA’s use of the word 
“customer.” We do not believe that the use of this word in and of itself played a role in 
how the Eclipse certification was handled. As Mr. Hickey described at length at the 
hearing, there has long been in place a process to resolve problems and disputes that 
arise during a certification process. Engineering is not a black and white exercise, but 
rather one that is shades of gray. It is extremely common for two engineers to approach 
a problem, or how to resolve that problem, differently. The process used by the 
Aircraft Certification Service to identify, document and resolve differences in approach 
with respect to how to meet a regulatory standard are set out in FAA Order 81 10.4c and 
the Partnership for Safety Plans developed between the FAA and the applicant. 
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14. The IG testified that the FAA identified the EA-500 as a "priority certification.” Why does 
the FAA place a priority on one certification program over another? What made this so 
important from an FAA policy standpoint? 

RESPONSE: 


The FAA did not label the EA-500 as a “priority certification.” However, like most 
successful organizations, the FAA has a clear vision of its goals and objectives. At the 
highest level within the FAA, these goals and objectives are outlined in the FAA’s 
strategic plan, called the Flight Plan. The FAA Flight Plan contains broad, overarching 
goals along with objectives, strategies, and initiatives to attain those goals. 

The 2006-2010 FAA Flight Plan included a strategy to: “Establish standard procedures 
and guidelines for general aviation operators,” as well as a supporting initiative to, 
“Ensure that safety oversight and regulatory compliance keep pace with changes in the 
general aviation environment.” This strategy and initiative were in support of 
Objective 2, “Reduce the number of fatal accidents in general aviation,” under the FAA 
Flight Plan goal of Increased Safety. 

In support of this FAA Flight Plan goal, strategy, and initiative, the FY 2006 AVS 
Business Plan included a strategic activity to, “Support the operation of Very Light Jets 
(VLJs) in the NAS.” Completing certification of the Eclipse EA-500 was identified in 
the FY 2006 AIR Performance Plan as an example of a VLJ which would operate in the 
NAS. In hindsight, as Mr. Hickey stated at the hearing, this did lead to high focus on 
and attention to completion of this particular type certification program. 

As we acknowledged at the hearing, one of the lessons we have learned in this process 
is not to create objectives that rely on circumstances outside of our control, such as 
relying on another party meeting its own deadline. As Mr. Hickey noted at the hearing, 
we should be measuring our performance on our own ability to meet the deadlines to 
which we have committed, and that those deadlines could very well result in findings of 
noncompliance. 


14 



228 


15. The Inspector General found that the Eclipse Manager of Certification, Randy Griffith, had 
previously worked as an FAA official on the Eclipse certification. He resigned fi-om the 
FAA and went directly to work from Eclipse with no "cooling off period. Is this 
appropriate? 

RESPONSE: 


At the time Randy Griffith left FAA and went to work for Eclipse, there was no 
required cooling off period for someone in his position. There still is not one. 
Therefore, Mr. Griffith accepting a position with Eclipse was appropriate. It is quite 
common for former FAA employees to go to work for industiy and vice-versa. Both 
FAA and private industry benefit from employees with a range of aviation experience 
and expertise. It would be an extreme hardship to prohibit an FAA employee from 
going to work for the private sector in the aviation industiy for some set period of time 
because he or she worked for the FAA. Limitations on some types of interaction by a 
former FAA employee on behalf of his or her new company may be appropriate, and 
are defined by 18 U.S.C. §§ 207 and 208. 
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16. It has been pointed out to us that Eclipse had contractual agreements for additional 

financial backing, as well as employee bonuses and stock options tied to that date. Were 
you aware of that? 

RESPONSE: 


The FAA was aware that Eclipse had business reasons for wanting to meet the target 
date. However, FAA had no documented information about the specifics of either 
Eclipse’s contractual agreements for financial backing or employee bonuses. The 
certification schedule was jointly agreed to by Eclipse and FAA. 
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17. Why in the world is it appropriate for FAA to accept lOUs for things that are deficient in 
exchange for approving certification? Why not wait until all non-compliant items have 
been fixed before approval? 

RESPONSE: 


For clarification, the FAA assumes that the reference to lOUs and certification approval 
refers to the type certification process and the agreement that Eclipse would maintain 
operational control of all certificated aircraft until the requirements of “DO-178B” were 
met. 

A Technical Standard Order Authorization (TSOA) allows a component manufacturer 
to certify its product for use in multiple aircraft. A TSOA is not required to obtain a 
type certificate. When an airplane is certified and contains components without 
TSOAs, the aircraft manufacturer becomes responsible for the component, both in the 
design and in the production. 

To receive TSOA approval for certain types of software-driven avionics such as the one 
Avidyne was developing, an applicant is explicitly required to demonstrate satisfactory 
completion of the industry standard, referred to as “DO-178B.” However, to receive a 
type certificate, there is no explicit requirement to meet DO-178B. The regulation 
governing this lists multiple ways to meet the requirements. Consequently, Eclipse 
submitted a plan to meet the type certification requirements through a combination of 
ground tests, flight tests, laboratory tests, and other activities. This certification 
approach is common for components of an aircraft. 

As the Special Certification Review team found, the “lOU” had no bearing on the TC 
being issued since the aircraft met the applicable standards and had no unsafe feature or 
characteristic. The “lOU” applied to Avidyne’s evenmal compliance with DO-178B in 
order to receive its TSOA, which it did in March 2007. Pending that eventual 
compliance, Eclipse agreed to maintain operational control of all certificated aircraft. 
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18. Mr. Hickey, one of major problems identified prior to TC approval was that the software 
only met 23 of the 65 requirements outlined under the industry-standard software approval 
criteria (DO-178B). You and Mr. Wojnar ignored this and found "an alternative means" for 
avionics software approval. If 40 or more items could not be demonstrated to be 
compliant, how in the world, could you be comfortable with an alternative means of 
compliance and ignore the only widely accepted industry standard? 

RESPONSE: 


First, the FAA would like to clarify that Ron Wojnar had no involvement in the topic 
covered by this question. Mr. Wojnar became involved in the airworthiness and 
production certification in March-April 2007, several months after the type design was 
approved in September 2006. 

As noted in Question 17 above. Federal Aviation Regulation (FAR) 21.305 states that 
parts and appliances may be approved under a parts manufacturer approval (PMA), 
technical standard order (TSO), in conjunction with type certification procedures for a 
product, or in any other manner approved by the Administrator. As stated above. 
Eclipse chose to certify the electronic flight instrument system (EFIS) under the type 
certification, and the EFIS was properly certificated using appropriate airworthiness 
standards. The applicable airworthiness standards when certificating under the type 
design are FAR 23. 1 30 1 and 23. 1 309. Although FAA advisory circular (AC) 23. 1 309- 
1 provides that DO-178B is an acceptable means of compliance with these standards, 
the AC states that the guidance is, “an acceptable means, but not the only means”, for 
showing compliance. The AC goes on to say, “This material is neither mandatory nor 
regulatory in nature and does not constitute a regulation.” The applicant has the option 
of using a different means of compliance. 

The SCR team specifically reviewed this topic and found that the data presented to the 
airplane certification office was adequate for showing compliance with FAR 23.1301 
and 23.1309 for the EFIS at the time of type certification. 
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19. You say the "Midway software problem" was never seen in the certification program, but 
many other software problems were. Since software is at the heart of the entire EA-500 
design, doesn't the existence of unknown and unverified features of the design lead one to 
be uncomfortable in approving it? Yet you overruled expert software engineers who 
refused to sign off because it had not been properly verified. 

RESPONSE: 


The electronic flight instrument system (EFIS) software and full authority digital 
engine control (FADEC) software are completely different issues. The issue regarding 
appropriate software certification standards that arose in September 2006 was related to 
the electronic flight instrument system (EFIS) software, not the FADEC software. 

The incident at Chicago Midway on June 5, 2008 was related to a failure not associated 
with the software. After this incident, the FAA immediately reviewed the details of the 
incident and quickly determined appropriate corrective action. We issued an 
emergency airworthiness directive (AD) on June 12, 2008, requiring before-further- 
flight evaluation of Eclipse throttles and incorporation of an airplane flight manual 
(AFM) procedure for dual engine control failure. This AD grounded the fleet until the 
throttle evaluation and AFM updates were completed. The issues leading to the 
incident were not known at the time of type certification, and once they were known, 
the FAA took immediate action to address them. 
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20. You said the problems with the airplane occurring today were not seen in the certification 
program, but issues that have occurred were warned about by the certification team. Why 
were you so reluctant to trust your own experts? 

RESPONSE: 


The FAA is not reluctant to trust our own experts. These same experts identified and 
resolved problems during the certification process. Ultimately, these same experts 
issued the certifications for the EA-500. 

We are aware of one problem that arose in service that is related to a potential issue 
discussed during type certification - drainage of moisture fiom the pitot system. The 
certification team thoroughly evaluated this potential issue and believed it was 
satisfactorily addressed before type certificate issuance. Problems in service that were 
unanticipated at the time of certification are not rare, which is why the FAA continues 
safety oversight of aircraft and operations. 

As with any type certification program, many potential issues arose during the Eclipse 
program, and each was thoroughly evaluated. It is important to note that the FAA’s 
role is to review the design issues for areas of non-compliance and unsafe 
characteristics or features. If a design is able to be shown compliant and does not have 
unsafe characteristics or features, then the design issue may be undesirable to the 
customer/operator, but has no bearing on the issuance of a type certificate. Most issues 
that have occurred in service on the Eclipse EA-500 are of this nature. 
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2 1 . It appears the approval process was a bit “backwards” here. Rather than acting upon 
design concerns, you seemed to try to find reasons that it was OK, even though design 
flaws were seen and identified. The pitot-static system is a good example of this, is it 
not? 

RESPONSE: 


The pitot static system received an equivalent level of safety (ELOS) determination 
because the team concluded that the design was safe and not flawed. The ELOS 
finding was made based on the existence of compensating factors that were determined 
to provide an equivalent level of safety to pitot-static drains. Once the aircraft was type 
certified and began operations at altitude, freezing in the lines leading up to the pitot 
probe was detected. A design change was made that rerouted the lines and added a 
drain to the system and these changes were required by an airworthiness directive. It is 
quite common for operational experience to reveal safety issues that were not detected 
during type certification and are subsequently corrected through airworthiness 
directives. 
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22. Is it sufficient that just because you don't see a problem during a certification evaluation, it 
is OK for approval, especially when highly qualified engineers and pilots pinpoint potential 
design deficiencies? 

RESPONSE: 


The type certification process is based on finding compliance to the regulations, which 
are performance-based regulations. Throughout the certification program, the FAA 
team works with the applicant on the identification of failure modes and design issues 
so that a finding of compliance can be made. Identification, follow-on discussions and 
an action plan to address potential failures are a part of the process. The applicant is 
then responsible to develop its compliance plan and make the demonstration of 
compliance to the FAA. 

The FAA examines the type design, completes the appropriate tests and inspections, 
and determines whether the product meets the applicable airworthiness requirements or 
that any airworthiness provisions not complied with are compensated for by factors that 
provide an equivalent level of safety. Upon the FAA’s finding that the product 
complies, and that no feature or characteristic makes the product unsafe, the applicant is 
entitled to a type certificate under the Federal Aviation Regulations. 

As with any type certification program, many potential issues arose during the Eclipse 
program, and each was thoroughly evaluated. It should be noted that many potential 
issues that arise during a type certification program are neither non-compliances nor 
unsafe conditions. In such cases, the issue has no bearing on the issuance of a type 
certificate. Most issues that have occurred in service on the Eclipse EA-500 are of this 
nature. Any issues that have represented a non-compliance or unsafe condition have 
already been addressed or are being addressed. 

We did acknowledge at the hearing that there were failures in communication, 
coordination and documentation with respect to certain aspects of both the type and 
production certification processes. These failures have resulted in misperceptions and 
we must strive to improve in these areas in order to avoid some of the problems we 
encountered with Eclipse in future certifications. 
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23, The FAA has now issued several pitot-static system airworthiness directives (ADs), the 
latest on September 9, because it has now been shown that the approved design is indeed 
defective and causes the very problems warned about. This looks like just one more 
example of where the FAA did not exercise adequate due-diligence and was more 
concerned about helping the manufacturer over satisfying safety oversight responsibilities. 
Please comment. 

RESPONSE: 

The equivalent level of safety (ELOS) finding that the team made for the Eclipse 
EA-500 pitot/angle-of-attack probe was based on a thorough review of the design. 
Although the probe’s design had no provisions for water drainage, the team 
determined that compensating features existed which would provide an equivalent 
level of safety to the airworthiness standard. One of these compensating features 
was that the pitot system was shown by testing to be resistant to the ingress of 
water, and that water in the system would not adversely affect the operation of the 
pitot system. Another compensating feature was that the heated probe was the low 
point in the pitot system, and that any moisture or liozen water would be vaporized 
by the heated probe. 

The ELOS finding was made as provided for in FAR 21.21. FAA followed policy in 
Order 81 10.4, which included the development of an issue paper to define the issue and 
facilitate its thorough examination by both the Airplane Certification Office in Ft. 
Worth and the Small Airplane Directorate Standards Office in Kansas City. Per the 
FAA order, a memorandum documenting the ELOS finding was prepared and approved 
by management in both the Airplane Certification Office and the Small Airplane 
Directorate. 

The process for making an equivalent level of safety finding is rigorous and thorough. 
The equivalent level of safety finding made for the pitot probe on the Eclipse EA-500 
was appropriate given the data and information known at the time of type certification. 

After type certification, we received reports of loss of primary airspeed indication due 
to freezing condensation within the pitot system. As a result. Eclipse developed a 
design modification, and we mandated it through airworthiness directive action. It is 
not uncommon for service experience to reveal safety issues not known or understood 
during the type certification process and that must be corrected by airworthiness 
directive action. 
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24. It has been a controversial topic for years that FAA uses less rigorous safety standards for 
aircraft that are smaller and with fewer seats. Should FAA re-evaluate its certification 
regime and apply more rigorous standards according to the complexity of the aircraft, as 
opposed to the number of seats in the aircraft? 

RESPONSE: 


Part 23 of the Federal Aviation Regulations (FARs) contains appropriate minimum 
airworthiness standards for most small airplanes. When we find that a proposed design 
aspect of an airplane contains technology not envisioned by FAR Part 23, we apply any 
necessary additional airworthiness standards through the issuance of special conditions 
per FAR 21.16. We applied such special conditions on the Eclipse type certification 
program. 

The FAA reevaluated the appropriateness of its light jet certification requirements in 
the late 1990’s, as the Eclipse and Safire jets began development. Before the late 
1990’s, the FAA had certified several light jets and had traditionally applied special 
conditions that increased the performance standards. Applying these special conditions 
was consistent with light jet technology at the time, which typically resulted in jets 
having high takeoff and landing speeds (and long takeoff and landing distances) when 
compared to piston-twin-engine airplanes. 

However, as the Eclipse EA-500 design was being developed in the late 1990’s, early 
performance estimates showed that the EA-500’s takeoff and landing speeds and 
distances were acmally closer to light piston-twin-engine airplanes than typical 
transport category jets. These perfoimance estimates showed that the FAA’s previous 
assumption on jet performance was outdated and the FAA needed to reevaluate its 
certification standards for jets against existing small airplanes, especially for the lighter 
weight jets. 

After the Eclipse reevaluation, the FAA determined that the appropriate airworthiness 
standards for light jets weighing 6,000 pounds or less (like the Eclipse EA-500) were 
the existing FAR 23 rules for normal category airplanes. These airworthiness standards 
require all turbine-powered airplanes under 6,000 pounds to meet many of the same 
performance standards for piston twin engine airplanes over 6,000 potmds. 

The FAA determined that the existing airworthiness standards were appropriate and 
sufficient in most areas for the Eclipse EA-500 type certification. However, we did 
find that a few airworthiness standards were inadequate or inappropriate because of 
novel or unusual design features. As a result, we issued certain special conditions, as 
provided for in FAR 21.16, which became part of the certification basis for the Eclipse 
EA-500. 

In 2003, an Aviation Rulemaking Committee (ARC) was formed to review the 
certification and operational requirements for small jets. The group reviewed normal 
and commuter category airworthiness standards, as well as existing special conditions. 
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The ARC recommended modifying 41 existing Part 23 rules. Most of the 
recommendations are based on the current special conditions applied to Part 23 jets. 

In addition, one of the Special Certification Review (SCR) team’s recommendations 
was for the FAA to reevaluate the criteria for applicability of function and reliability 
(F&R) testing. We agree with this recommendation and have already implemented a 
solution. We had already developed a generic issue paper to apply F&R testing 
requirements to turbojets weighing less than 6000 poimds. We are currently applying 
F&R requirements, via special condition, on two active projects; the Diamond D-Jet 
and the Cirrus jet. We will continue to have internal discussions to determine if a rule 
change to FAR 21.35 requiring F&R testing for turbojet powered airplanes less than 
6000 pounds is appropriate. 
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25. The "Special Certification Review 'Team" (SRT) was initiated by FAA on August 1 1, 

2008, after word of the IG and Committee investigation leaked out, and looked specifically 
at 4 certification issues. It does not appear to have focused on the larger policy issues that 
are the topic of this hearing. Would any of you care to comment? 

RESPONSE: 


The Eclipse Special Certification Review (SCR) team was established to evaluate 
specific issues of compliance regarding the type certification of the Eclipse Aviation 
EA500. A number of concerns were raised by employees since the issuance of the type 
certificate, and more recently, by whistleblowers reporting to the Oversight and 
Investigations Staff of the House Committee on Transportation and Infi-astructure. In 
cases where such questions are raised, it is appropriate to conduct an SCR in 
accordance with FAA Order 81 10.4C, Paragraph 2-7 e.(l). 

The Eclipse SCR team was tasked to objectively review and evaluate certain areas of 
type certification and continued operational safety information to determine if the type 
design complies with the 14 CFR part 23 requirements. Specifically, the SCR team 
was to: 1) review whether the aircraft was properly certificated in the following areas: 
aircraft trim, flaps, screen blanking, and stall speeds, in accordance with Federal 
Aviation Regulations Part 23 on the date the type certificate was issued; 2) review 
service difficulty reports (SDRs) to determine whether they indicate that concerns 
raised during the certification process are manifesting themselves in operation; and 3) 
determine whether SDR data indicate any other areas of concern in the operation of the 
aircraft. 

The SCR team final report identified 8 findings and made 6 recommendations, which 
have been accepted by the FAA. We are currently working to address the SCR team’s 
recommendations. 
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26. All of the SRT members were FAA officials, except for Mr. Mack, who was a hired 
consultant, correct? How can they be viewed as "independent?" 

RESPONSE: 


The Special Certification Review (SCR) team was convened to provide an objective 
assessment of whether the issuance of the type certificate for the EA-500 aircraft was 
appropriate and in accordance with applicable FAA regulations and standards. The 
goal was for the SCR to have completed its findings prior to the Committee’s hearing 
on September 17, 2008, in order for those findings to be considered at the hearing. 
Consequently, we sought a highly respected individual whose personal and professional 
integrity was well acknowledged to lead the team. We felt strongly that this individual 
should from outside the FAA. We believe our choice of Jerry Mack was a good one 
and we are appreciative of his efforts. 

The remainder of the team consisted of FAA employees, all of whom are experts in 
their respective fields and all of whom have are highly respected. None of the 
individuals on the SCR were involved in any aspect of the Eclipse certification they 
were charged with reviewing. The universe of individuals who have the expertise to 
analyze and evaluate the technical matters involved in aircraft certification is small. 
Most either work for FAA or have worked for FAA. 

We believe the SCR, led by Jerry Mack and comprised of FAA professionals highly 
respected by the aviation community, was appropriate and consistent with FAA policy. 
The report itself, which identifies FAA shortcomings in areas of coordination and 
communication, evidences that the FAA employees on the team were objective and felt 
empowered to tell the truth as they saw it. They were in no way influenced by FAA 
during their evaluation and we do consider them to have been an independent review 
team. 
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The team was appointed by Acting Administrator Bobby Sturgell and Nicholas 
Sabatini, Associate Administrator for Safety. 
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28. Mr. Wojnar, why did you implement new procedures that prohibited FAA inspectors from 
looking under the floorboards, when it was well documented that they were finding 
numerous manufacturing deficiencies that did not comply with the approved design? 

RESPONSE: 


The independent team appointed by Mr. Hickey in March 2007, which was led by Mr. 
Wojnar, found during the period of March 13-15, 2007, that aviation safety inspectors 
(ASIs) were not inspecting Eclipse airplanes as required by FAA Order 8120.2D. The 
order required: 

“24. FAA CONFORMITY DETERMINATIONS. Subsequent to the date of 
issuance of the TC and prior to the issuance of an APIS or PC, the MIDO/CMO has 
full responsibility for determining whether the product or part(s) thereof conform to 
the type design and are in a condition for safe operation. The MIDO/CMO has the 
responsibility for performing inspections of incoming materials (at the source, if 
necessary), installations, and the completed products. The MIDO/CMO has the 
responsibility for documenting each inspection on FAA Form 8100-1, Conformity 
Inspection Record, so that each product or part(s) thereof inspected has a complete 
inspection record.” 

No inspector was prohibited from completely inspecting airplanes, and floorboards and 
interior furnishings were removed when necessary to completely inspect the aircraft. 
However, the independent team was concerned that the ASIs should have completed 
the inspection of areas under floorboards earlier in the production process to prevent the 
need for subsequently removing the floorboards. 

Although floorboards and interiors were removed when necessary to re-inspect, the 
independent team recognized that for the long term, a plan was needed for completing 
the necessary inspections in-process (before floorboards and interiors were installed). 
Such a plan was agreed to on March 15, 2007, between the FAA and Eclipse. This plan 
was a, “Project Specific Certification Plan (PSCP) for Production Certification,” and 
provided for inspection of the airplanes prior to the installation of floorboards and 
interiors, eliminating the need for them to be removed. In addition, FAA ASIs 
inspected the airplanes when they were fiilly completed. This is standard practice in the 
FAA and industry. 

It is important to note that, regardless of the number of manufacturing deficiencies that 
were found during various inspections. FAA inspectors ensured that they did not issue, 
standard airworthiness certificates until all such discrepancies were corrected at the end 
of the assembly process. 
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29. Mr. Sabatini and Mr. Hickey, in your vsrritten testimony you state, "FAA professionals 

would never and, in this case, did not, certify an aircraft that they knew to be unsafe or one 
that did not meet standards." However, Michele Owsley, a Manager in Aircraft 
Certification Service, wrote a letter to Randy Griffith, the Certification Manager at Eclipse, 
on June 26, 2008 following the incident at Chicago Midway. One part of the letter states, 
"[0]ur review of the design information thus far indicates several design regulatory non- 
compliances," and goes on to raise questions regarding engine isolation, power plant 
controls and others. In light of this, do you stand by your written statement? 

RESPONSE: 


Yes. The FAA, including Ms. Owsley, did not know of any unsafe condition or 
noncompliance at the time of type certification. The Eclipse EA-500, like most other 
airplanes, has experienced issues in service after having been type certificated. The 
Chicago Midway incident revealed issues that were not known at the time of type 
certificate issuance. 
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30, Eclipse is part of a new generation of very light jets (VLJs), which have gained attention 
due to the fact that the price of these jets will be lower and because the advanced avionics 
software will make it easier for pilots to fly. Based on all of the issues that have been 
uncovered in these planes, do you think that's its safe for a single pilot, who may not have a 
wealth of experience, to be flying these planes? 

RESPONSE: 


VLJs have gained attention because of lower initial purchase costs, their new 
technology integrated systems, the ability of the airplanes to operate at high altitudes, 
and the increase in performance associated with jet operations. From a practical aspect, 
these VLJs are even easier to fly by a single pilot than most of the high performance 
turboprop airplanes currently flown by a single pilot at similar altitudes and airspeeds. 
In addition, pilots of VLJs are required to complete a formal training program leading 
to the issuance of a type rating for the specific airplane type, further increasing the 
safety of VLJ operations. In addition, the advanced avionics configurations being 
certificated in VLJs should make the airplanes easier to fly in single pilot operations, 
particularly for less experienced pilots. 

Although we believe the design characteristics and pilot training requirements will 
make VLJs safe for single pilot operations, the FAA evaluates each new airplane type 
during type certification testing to determine minimum flight crew requirements. Each 
VLJ that we certificate is examined and a determination made, per Federal Aviation 
Regulation (FAR) 23.1523, of the minimum flight crew required for that airplane type. 

During the type certification program, the EA-500 was put through evaluation for the 
express purpose of determining the minimum flight crew requirement. The evaluation 
team consisted of five FAA test pilots and one FAA flight test engineer. The team 
determined the minimum crew required was a pilot and copilot (crew of two), or a 
single pilot provided certain equipment was available. 

Separate from the type certification program, the FAA’s Flight Standardization Board 
(FSB) evaluated the Eclipse EA-500. The FSB determined the training requirements 
needed for safe single-pilot operations in the EA-500 airplane. Each pilot who is issued 
a type rating for flying the EA-500 as a single pilot completes a rigorous training and 
testing process. 

Both of these elements are important for single pilot operations; the airplane must be 
designed such that it can be safely flown by a single pilot, and the pilot must be 
adequately trained, qualified, and current to fly the airplane as a single pilot. Both of 
these elements exist with the EA-500. It is safe for a properly trained and appropriately 
rated single pilot to fly a properly equipped Eclipse EA-500. 
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3 1 . Before embarking on a VLJ certification project, why did FAA not reevaluate its 
certification requirements for the needs of such a jet? 

RESPONSE: 


Part 23 of the Federal Aviation Regulations (FARs) contains appropriate minimum 
airworthiness standards for most small airplanes. When we find that a proposed design 
aspect of an airplane contains technology not envisioned by FAR Part 23, we apply any 
necessary additional airworthiness standards through the issuance of special conditions 
per FAR 21.16. We applied such special conditions on the Eclipse type certification 
program. 

The FAA reevaluated the appropriateness of its light jet certification requirements in 
the late 1990’s, as the Eclipse and Safire jets began development. Before the late 
1990’s, the FAA had certified several light jets and had traditionally applied special 
conditions that increased the performance standards. Applying these special conditions 
was consistent with light jet technology at the time, which typically resulted in jets 
having high takeoff and landing speeds (and long takeoff and landing distances) when 
compared to piston-twin-engine airplanes. 

However, as the Eclipse EA-500 design was being developed in the late 1990’s, early 
performance estimates showed that the EA-500’s takeoff and landing speeds and 
distances were actually closer to light piston-twin-engine airplanes than typical 
transport category jets. These performance estimates showed that the FAA’s previous 
assumption on jet performance was outdated and the FAA needed to reevaluate its 
certification standards for jets against existing small airplanes, especially for the lighter 
weight jets. 

After the Eclipse reevaluation, the FAA determined that the appropriate airworthiness 
standards for light jets weighing 6,000 pounds or less (like the Eclipse EA-500) were 
the existing FAR 23 rules for normal category airplanes. These airworthiness standards 
require all turbine-powered airplanes under 6,000 pounds to meet many of the same 
performance standards for piston twin engine airplanes over 6,000 pounds. 

The FAA determined that the existing airworthiness standards were appropriate and 
sufficient in most areas for the Eclipse EA-500 type certification. However, we did 
find that a few airworthiness standards were inadequate or inappropriate because of 
novel or unusual design features. As a result, we issued certain special conditions, as 
provided for in FAR 21.16, which became part of the certification basis for the Eclipse 
EA-500. 

In 2003, an Aviation Rulemaking Committee (ARC) was formed to review the 
certification and operational requirements for small jets. The group reviewed normal 
and commuter category airworthiness standards, as well as existing special conditions. 
The ARC recommended modifying 41 existing Part 23 rules. Most of the 
recommendations are based on the current special conditions applied to Part 23 jets. 
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In addition, one of the Special Certification Review (SCR) team’s recommendations 
was for the FAA to reevaluate the criteria for applicability of function and reliability 
(F&R) testing. We agree with this recommendation and have already implemented a 
solution. We had already developed a generic issue paper to apply F&R testing 
requirements to turbojets weighing less than 6000 pounds. We are currently applying 
F&R requirements, via special condition, on two active projects; the Diamond D-Jet 
and the Cirrus jet. We will continue to have internal discussions to determine if a rule 
change to FAR 21 .35 requiring F&R testing for turbojet powered airplanes less than 
6000 pounds is appropriate. 
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32. Why was a production certificate (PC) awarded when there were known deficiencies in the 
supplier and quality control systems? 

RESPONSE: 


The production certification board that convened to examine the company for its 
production certificate found that it met the two basic requirements in the rules: first, 
that Eclipse had established a quality control system, and second, that it could maintain 
that quality control system. Therefore, the PC was issued. 

In February 2007, the FAA conducted a District Office Audit in preparation for the 
issuance of a PC at Eclipse. During the audit, 42 non-compliances were documented. 
All 42 items and corrective actions were evaluated and found acceptable by the FAA. 
Twenty-nine of the 42 were closed immediately. That left thirteen (13) non- 
compliances, which had follow-up actions to be completed. It is not uncommon to 
have non-compliances that take long term corrective actions to resolve and still meet 
the requirements to receive a PC. 
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33. Why did FAA allow Eclipse to use alternate means of compliance to meet design 

certification requirements, despite unresolved design problems, which are still ongoing 
today? 

RESPONSE: 


The FAA did not allow Eclipse to use an “alternate means of compliance” to meet 
design certification requirements. The term “alternate means of compliance” or 
“AMOC” has been mischaracterized as a way of showing compliance differently Ifom 
the normal or established manner. To clarify: the term AMOC is typically associated 
with an Airworthiness Directive (AD). The AD is a regulatoiy requirement which 
defines “specific” actions to occur within a specific timeframe, to address an unsafe 
condition. In this sense, an AMOC is a means to use an “alternate” or different method 
from that defined in the AD, to correct the unsafe condition and comply with the AD. 
Compliance via an AMOC provides the same level of safety as compliance per the 
means outlined in the AD. 

As explained in the responses to Questions 12 and 17, there are “alternative” ways 
to show compliance for a certification program. Compliance can be shown through 
various regulatory mechanisms, including for example Special Conditions, 

Equivalent Level of Safety (ELOS) finding, and Exemptions. All of these 
examples, plus the options outlined in 14 C.F.R. § 21.305, are legally defined 
options for showing compliance. If these options were not allowed, the FAA would 
not have a regulatory method of compliance available to support new, irmovated 
aircraft designs, or parts, which are crucial to the continued advancement in 
aviation technology and safety. 
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34. FAA officials have continuously downplayed the significance of the "false" or 

inappropriate stall warnings that pilots continue to experience with this plane. When a 
single pilot, who does not have the breadth of experience needed, sees a stall warning pop 
up, don't you think that would send the pilot into a panic? When is the pilot supposed to 
know if they should take the stall warning seriously or not? It seems that this may be 
dangerous for the plane to "cry wolf’, in effect. 

RESPONSE: 


Pilots are trained, examined, and rated to fly specific types of aircraft. If a pilot 
receives a type rating to fly an EA-500, it means he or she has demonstrated the 
required proficiencies to handle the aircraft in a range of situations and circumstances. 
We would not expect a pilot who receives an Eclipse type rating to panic as the result 
of receiving a stall warning. The pilot should respond, as trained, to any stall warning 
s/he receives. The stall warning system met certification standards. In fact, some of 
what has been characterized as “false” warnings, were in fact appropriate warnings 
because the operational speeds in the training manual were inaccurate. Subsequent to 
certification and before the first airplane was ever delivered to a customer. Eclipse 
increased some of the speeds in the training manual and airplane flight manual. These 
actions effectively reduced the “false” stall warnings. 
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Questions Addressed at the Hearing (09-17-2008) 

If you would like, you may provide additional responses and information to the 
questions that were addressed at the hearing. 

35. Do you think it is appropriate for senior FAA management to set specific dates for 

certification approval, in formal executive performance goals, for when a new aircraft is 
going to be certified? 

RESPONSE: 


Senior FAA management did not set specific dates for certification approval. With 
regard to the controversial date in the type certification, September 30, 2006, that date 
was set by the applicant. This is a very common practice in certification programs. 

The applicant proposes the schedule for certification, which the FAA then reviews. 
Depending upon resource allocation, vacation time, other simultaneously occurring 
projects, etc., the certification schedule may be modified. This allows both the FAA 
and the applicant to allocate resources and otherwise plan for the management of the 
certification program. 

One of the lessons we have learned is to not place significant focus or attention on 
completion of a type certification program when such an event is in many ways out of 
the control of the FAA. Based on that lesson, we have changed the way we write our 
organizational goals. Now when we build our FAA Flight Plan, Aviation Safety 
business plan, and Aircraft Certification Service performance plan, we establish 
objectives that are within the control of the FAA to meet. We do this so that we do not 
place undue pressure on individuals to meet certain deadlines when those deadlines are 
outside of FAA’s control. 
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36. Isn't it true that the date when an aircraft is certified is almost exclusively in the control of 
the manufacturer, and NOT the FAA? 

RESPONSE: 


It is true that the applicant must submit the type design, test reports, and computations 
necessary to show that the airplane meets the applicable certification requirements and 
therefore is the primary “driver” of the certification schedule. It is the FAA’s 
responsibility to review the applicant’s submittals and find that the airplane complies 
with the appropriate standards. 

The FAA works with each applicant via a Project Specific Certification Plan (PSCP). 
These plans facilitate the certification program by allowing the FAA and the applicant 
to mutually plan the program milestones based on the available resources. The FAA 
and the applicant discuss the milestones of a certification program and each commit to 
actions. For example, if the applicant wants to begin type inspection authorization 
(TIA) testing by a certain date, then the FAA requires certain data submittals and 
certain actions, such as a conformity inspection, to be completed by a reasonable date 
in advance of the TIA test date, to allow time to review the data and approve or 
disapprove it. These milestones and timelrames are agreed to between the applicant 
and the FAA. Once the PSCP is signed, each party abides by the schedule and is 
accountable if it misses one of its deadline. 
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37. Don't you think that the FAA should, as a matter of policy, not be concerned about when, an 
aircraft is certified, just that it is safe for certification? 

RESPONSE: 


The FAA’s focus in all type certification projects is on determining whether the product 
meets the appropriate standards and whether it has any unsafe feature or characteristic. 
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38. Do you believe that it is appropriate for the FAA to concern itself with the fact that its 
certification decisions, or delays in certification, may cause financial hardship for a 
company? 

RESPONSE: 


FAA’s primary focus is always safety. Delays in the certification process often occur 
and did with respect to the certification of the EA-500. We do not hesitate to make 
certification decisions that result in program delays. At the same time, we caimot 
ignore the fact that we must be good stewards of the public trust as we carry out our 
responsibilities. We do this by following our processes and fttifilling our obligations 
within a reasonable, mutually agreed upon time frame whenever possible 
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39. The bottom line here is that there is strong "appearance" that you bent over backwards to 
make sure the EA-500 got certified by the date the company wanted. Your own records 
show you spent more money on this certification than any other comparable program. 
Wouldn’t it have been more prudent to wait until all the design problems identified had 
been corrected? Why was 9/30 so important? 

RESPONSE: 


The FAA is responsible for the issuance of the type certificate. If the airplane meets the 
applicable airworthiness standards and has no unsafe feature or characteristic, then the 
applicant is entitled to a type certificate. 

We know of no other certification program comparable to the Eclipse EA-500. This 
was a new company developing an all-new airplane that incorporated new technology, 
both in its design and manufacture. The company was located in a city that was not 
home to either an FAA airplane certification office or a manufacturing inspection 
district office. The project was managed by an FAA office that needed to supplement 
its certification team with FAA personnel Ifom other FAA offices. The certification 
program extended to over 5 years instead of the typical 3 years. FAA management of 
the program transferred fi'om one airplane certification office to another during the 
middle of the program. All of these factors combined to result in a significant draw on 
FAA resources, both in labor hours as well as in travel funds. These labor hours and 
travel expenditures were necessary for the FAA to adequately carry out its function of 
examining the type design, completing the necessary tests and inspections, and 
determining whether the product met the applicable certification requirements. 
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40. We've heard testimony that Mr. Hickey applied imusual or inappropriate pressure on FAA 
engineers and inspectors to approve the aiicrafl because of his self-imposed executive 
performance goal to get it done. Please explain why you think so many people have 
complained about yoirr decisions in this case? 

RESPONSE: 


As Mr. Hickey testified at the hearing, in the case of Eclipse, there were problems with 
coordination, consultation and documentation that may have left certain employees 
feeling that their positions had not been thoroughly considered. This is a failing that we 
acknowledge and are working to rectify in future certifications. Mr. Hickey is a hands- 
on manager who is determined to hold his employees accountable for meeting stated 
goals whenever possible. He expects them to work hard to identify, understand and 
overcome problems. He considers it part of his job to intervene when he learns that 
people are not working through problems, as he intervened in the case of Eclipse. It is 
appropriate for sertior executives to make difficult decisions, even if those decisions 
make some people unhappy. 
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41. Mr. Hickey, we've heard from two different witnesses that you convened a meeting a few 
weeks before the TC was approved, and that you were unusually harsh, some have said 
abusive. It is reported you said, "We are here to save a company.” T hat causes us great 
concerns in light what many of us consider the "overly cozy" relationship the FAA seems 
to have developed with industry of late. Please comment. 

RESPONSE: 


As noted in response to Question 40, we acknowledge that some employees were 
unhappy with the manner in which Mr. Hickey intervened in the Eclipse type certificate 
process. However, at no time did he say that it was up to FAA to save the company. 
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42. 


Mr. Hickey why did you reassign FAA personnel who found design problems with the 
aircraft and refused to sign off on the design? That looks very suspicious, as it did to the 


IG. 


RESPONSE: 


No one was reassigned during the EA-500 type certification process (when the design 
of the aircraft is examined) because of his or her actions or decisions on the project. 
Personnel reassignments that occurred during this time were made by the respective 
office managers and were associated with routine resource management over the course 
of a lengthy program. In no case did Mr. Hickey reassign any FAA personnel during 
the type certification program. 
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43. Mr. Hickey, you sent Mr. Downey the manager of the Ft. Worth office a letter of reprimand 
when you relieved him of that responsibility, saying among other things, that he failed to 
work well with the customer. It appears that his "failure" was based upon his strong belief, 
based upon his expert credentials, that the design was not ready for approval. You then sent 
your former Deputy, Mr. Wojnar to take over. Doesn't this look a bit cozy? 

RESPONSE: 


To clarify one point, the EA-500 had already received its type certificate when we sent 
the letter to Mr. Downey, and his own testimony states that he stood by that 
certification. By his own statements, Mr. Downey did not believe that the design was 
not ready for approval. 

During the production certification process, Mr. Hickey became aware of practices and 
behavior of certain FAA employees that he fmmd inappropriate. When Mr. Hickey 
learned that Mr. Downey was aware of the employee actions and was, apparently, 
untroubled by them, he lost confidence in Mr. Downey’s ability to effectively manage 
the process. Because he no longer believed that Mr. Downey was capable of providing 
objective oversight and guidance, Mr. Downey was removed from the Eclipse project. 

Mr. Hickey felt strongly that he needed to understand whether FAA personnel were 
acting within the scope of appropriate regulations and guidance or were imposing 
requirements beyond the regulatory minimums. He appointed a team comprised of 
objective experts, led by Mr. Wojnar. Mr. Wojnar was selected to head the team 
because of his years of expertise and his unquestionable integrity. The team was 
charged with understanding both sides of the allegations of misconduct and helping to 
work through the problems that existed. 
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44. We now know that software problems led to both engines freezing at full power and were 
responsible for a near fatal accident at Midway on June 5, 2008. Even the FAA official 
(Ms. Owsley) who signed the original TC now acknowledges that certain features of the 
software are not compliant. Shouldn't it have been a clue that software might be a 
significant problem given the aircraft could not satisfy the industry-std. certification 
methodology? 

RESPONSE: 


Following a wind shear encounter on final approach, the pilot of an Eclipse EA-500 
airplane applied full throttle using enough force against the forward stops to exceed the 
design throttle position signal maximum range. The associated fault mode held the 
engine thrust settings at the last known throttle position, which was maximum. 
Following the balked landing, the pilot elected to shutdown one engine. Upon 
shutdown of the one engine, the opposite engine thrust reduced to idle and was 
unresponsive to subsequent throttle lever movement. The pilot was able to land the 
airplane with no injury or substantial damage. 

The FAA immediately reviewed the details of this incident and quickly determined 
appropriate corrective action. We issued an emergency airworthiness directive (AD) on 
June 12, 2008, requiring before-further-flight evaluation of Eclipse throttles and 
incorporation of an airplane flight manual (AFM) procedure for dual engine control 
failure. This AD grounded the fleet until the throttle evaluation and AFM updates were 
completed. 

The issues leading to the incident were not known at the time of type certification, and 
once they were known, the FAA took immediate action to address them. 
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45. The Ft. Worth certification team was also concerned about the design of the pitot (PEE- 
TOE) static system because it did not have moisture drains, which could cause 
contamination and inaccurate airspeed, rate of climb and altitude readings. They did not 
want to certify it, but the decision was transferred to another office in Kansas City. In this 
and other areas, it looks like the FAA went "answer shopping.” If you didn’t like the 
decision by one office or engineer, you went shopping for an affirmative answer elsewhere. 
Please comment? 

RESPONSE: 


The equivalent level of safety (ELOS) finding that we made for the Eclipse EA-500 
pitot/ang!e-of-attack probe was based on a thorough review of the design and was a 
finding made jointly by both the Airplane Certification Office in Ft. Worth and the 
Small Airplane Directorate. This was not a case of the decision being transferred to the 
office in Kansas City. Rather, both offices worked together to make the finding 
collaboratively. This is our normal process for making ELOS findings and is consistent 
with policy in FAA Order 8 1 10.4. We used an issue paper to define the issue and 
facilitate its thorough examination by both the Airplane Certification Office in Ft. 
Worth and the Small Airplane Directorate Standards Office in Kansas City. The issue 
paper was originated by engineers in the Airplane Certification Office, concurred with 
by engineers in the Standards Office, and approved by management in both offices. 
After completing the issue paper, a memorandum documenting the ELOS finding was 
prepared and approved by management in both the Airplane Certification Office and 
the Small Airplane Directorate. 

The process for making an equivalent level of safety finding is rigorous and thorough. 
The equivalent level of safety finding made for the pitot probe on the Eclipse EA-500 
was appropriate given the data and information known at the time of type certification. 
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46, One of the very interesting points made in the IG testimony was that the EA-500 did not 
“easily fit" into FAA's existing certification regimes because it represented a new class of 
aircraft that was very complex and more characteristic of complex, large transport category 
aircraft. Yet, the Eclipse was certified using more lenient general aviation guidelines. Was 
this prudent or appropriate? 

RESPONSE: 


We disagree with the assessment that the EA-500 is more characteristic of large 
transport category aircraft. Part 23 of the Federal Aviation Regulations (FARs) 
contains appropriate minimum airworthiness standards for most small airplanes. When 
we find that a proposed design aspect of an airplane contains technology not envisioned 
by FAR Part 23, we apply any necessary additional airworthiness standards through the 
issuance of special conditions per FAR 21.16. We applied such special conditions on 
the Eclipse type certification program. 

The FAA reevaluated the appropriateness of its light jet certification requirements in 
the late 1990’s, as the Eclipse and Safire jets began development. Before the late 
1990’s, the FAA had certified several light jets and had traditionally applied special 
conditions that increased the performance standards. Applying these special conditions 
was consistent with light jet technology at the time, which typically resulted in jets 
having high takeoff and landing speeds (and long takeoff and landing distances) when 
compared to piston-twin-engine airplanes. 

However, as the Eclipse EA-500 design was being developed in the late 1990’s, early 
performance estimates showed that the EA-500’s takeoff and landing speeds and 
distances were actually closer to light piston-twin-engine airplanes than typical 
transport category jets. These performance estimates showed that the FAA’s previous 
assumption on jet performance was outdated and the FAA needed to reevaluate its 
certification standards for jets against existing small airplanes, especially for the lighter 
weight jets. 

After the Eclipse reevaluation, the FAA determined that the appropriate airworthiness 
standards for light jets weighing 6,000 pounds or less (like the Eclipse EA-500) were 
the existing FAR 23 rules for normal category airplanes. These airworthiness standards 
require all turbine-powered airplanes imder 6,000 pounds to meet many of the same 
performance standards for piston twin engine airplanes over 6,000 pounds. 

The FAA determined that the existing airworthiness standards were appropriate and 
sufficient in most areas for the Eclipse EA-500 type certification. However, we did 
find that a few airworthiness standards were inadequate or inappropriate because of 
novel or unusual design features. As a result, we issued certain special conditions, as 
provided for in FAR 21.16, which became part of the certification basis for the Eclipse 
EA-500. 
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In 2003, an Aviation Rulemaking Committee (ARC) was formed to review the 
certification and operational requirements for small jets. The group reviewed normal 
and commuter category airworthiness standards, as well as existing special conditions. 
The ARC recommended modifying 41 existing Part 23 rales. Most of the 
recommendations are based on the current special conditions applied to Part 23 jets. 

In addition, one of the Special Certification Review (SCR) team’s recommendations 
was for the FAA to reevaluate the criteria for applicability of function and reliability 
(F&R) testing. We agree with this recommendation and have already implemented a 
solution. We had already developed a generic issue paper to apply F&R testing 
requirements to turbojets weighing less than 6000 pounds. We are currently applying 
F&R requirements, via special condition, on two active projects: the Diamond D-Jet 
and the Cirrus jet. We will continue to have internal discussions to determine if a rule 
change to FAR 21.35 requiring F&R testing for turbojet powered airplanes less than 
6000 pounds is appropriate. 
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47. Should FAA reevaluate how it is treating this new class (VLJs) of aircraft for certification? 
RESPONSE: 


Part 23 of the Federal Aviation Regulations (FARs) contains appropriate minimum 
airworthiness standards for most small airplanes. When we find that a proposed design 
aspect of an airplane contains technology not envisioned by FAR Part 23, we apply any 
necessary additional airworthiness standards through the issuance of special conditions 
per FAR 21.16. We applied such special conditions on the Eclipse type certification 
program. 

The FAA reevaluated the appropriateness of its light jet certification requirements in 
the late 1990’s, as the Eclipse and Safire jets began development. Before the late 
1990’s, the FAA had certified several light jets and had traditionally applied special 
conditions that increased the performance standards. Applying these special conditions 
was consistent with light jet technology at the time, which typically resulted in jets 
having high takeoff and landing speeds (and long takeoff and landing distances) when 
compared to piston-twin-engine airplanes. 

However, as the Eclipse EA-500 design was being developed in the late 1990’s, early 
performance estimates showed that the EA-500’s takeoff and landing speeds and 
distances were actUcdly closer to light piston-twin-engine airplanes than typical 
transport category jets. These performance estimates showed that the FAA’s previous 
assumption on jet performance was outdated and the FAA needed to reevaluate its 
certification standards for jets against existing small airplanes, especially for the lighter 
weight jets. 

After the Eclipse reevaluation, the FAA determined that the appropriate airworthiness 
standards for light jets weighing 6,000 pounds or less (like the Eclipse EA-500) were 
the existing FAR 23 rules for normal category airplanes. These airworthiness standards 
require all turbine-powered airplanes under 6,000 pounds to meet many of the same 
performance standards for piston twin engine airplanes over 6,000 pounds. 

The FAA determined that the existing airworthiness standards were appropriate and 
sufficient in most areas for the Eclipse EA-500 type certification. However, we did 
find that a few airworthiness standards were inadequate or inappropriate because of 
novel or unusual design features. As a result, we issued certain special conditions, as 
provided for in FAR 21.16, which became part of the certification basis for the Eclipse 
EA-500. 

In 2003, an Aviation Rulemaking Committee (ARC) was formed to review the 
certification and operational requirements for small jets. The group reviewed normal 
and commuter category airworthiness standards, as well as existing special conditions. 
The ARC recottunended modifying 41 existing Part 23 rules. Most of the 
recommendations are based on the current special conditions applied to Part 23 jets. 
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In addition, one of the Special Certification Review (SCR) team’s recommendations 
was for the FAA to reevaluate the criteria for applicability of function and reliability 
(F&R) testing. We agree with this recommendation and have already implemented a 
solution. We had already developed a generic issue paper to apply F&R testing 
requirements to turbojets weighing less than 6000 pounds. We are currently applying 
F&R requirements, via special condition, on two active projects: the Diamond D-Jet 
and the Cirrus jet. We will continue to have internal discussions to determine if a rule 
change to FAR 21.35 requiring F&R testing for turbojet powered airplanes less than 
6000 pounds is appropriate. 
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48. You say FAA asserts that it met all pertinent certification regulations, but comment that it 
is the totality of actions or inactions that raise reason for concern. Could you please 
elaborate? 

RESPONSE: 


To the best of our knowledge, no FAA official has commented that it is the totality of 
actions or inactions that raise reason for concern. We note that the FAA’s certification 
process and obligations are extremely complex. What may appear to the layperson as a 
reason for concern may in fact be a minor issue; conversely, what may not concern the 
average person may be of great consequence to our aviation experts. The certification 
of Eclipse was a challenging project. It is impossible to convey in a single overview 
the complexities and thousands and thousands of decisions that went into the aircraft’s 
certification. While there were certainly chaUenges at each stage of the certification 
process, at every stage, the EA-500 was ultimately determined to meet the certification 
requirements given the data and information known at the time. Thus, while the 
“totality of actions or inactions” is cited as a reason for concern, in fact, the certification 
program, as evaluated by our experts was found to meet all of the applicable 
regulations. In doing so, the applicant was legally entitled to certification under the 
Federal Aviation Regulations. 


52 



266 


49. Mr. Wojnar, you served on the Special Certification Review Team that looked at the 

Eclipse 500's certification process and issues. Do you think that it was appropriate for you 
to serve on this team, which was intended to conduct an independent review, when you 
yourself were personally involved in the airworthiness certification and productions 
certification processes? Mr. Hickey, since you sent Mr. Wojner down to oversee the 
production certification evaluation for you, would you like to comment on this? 

RESPONSE: 


The SCR was given a limited charter to review whether or not the issuance of a type 
certificate for the EA-500 aircraft was appropriate and in accordance with FAA 
regulations and policies. While the IG and Committee investigation ultimately focused 
on the production certificate as well, at the time the SCR was convened, the focus was 
primarily on matters involved with the issuance of the type certificate, which is why the 
charter was limited to the indentified issues. While Mr, Wojnar was involved in 
overseeing the process leading to the issuance of Eclipse’s production certificate, he 
had no involvement with the issuance of the type certificate. Consequently, it was not a 
conflict for Mr. Wojnar to review matters surrounding the issuance of the type 
certificate. 
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50. Wasn’t it a "conflict-of-interest" to appoint Mr. Wojner to serve on the Special 
Certification Review Team, when you handpicked him to "rescue" the production 
certification program? 

RESPONSE: 


As noted in the response to Question 49, there was no conflict of interest for Mr. 
Wojnar to review issues suirounding the issuance of Eclipse’s type certificate because 
he had no involvement in that certification. 
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5 1 . What are you views of the Inspector General's findings? 

RESPONSE: 

The FAA has reviewed the written testimony of the Inspector General and his office’s 
recommendations. We feel that in a number of instances there were misunderstandings 
and misrepresentations of the information provided to the Inspector General’s office, 
leading to inaccuracies in the statements throughout the testimony. One clear example 
of this is the reference to the “high frequency of tire failure”, and that the IG understood 
that “the high rate of tire failure was likely due to the fact that the aircraft was initially 
designed for use on “soft fields” (e.g., dirt and grass). This example, in addition to 
many others in the testimony misrepresents the issues and do not accurately depict the 
certification activities related to the Eclipse EA 500. 

The recommendations made in the testimony are presently being reviewed within our 
organization and will be considered as appropriate. 
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52. The FAA’s own test pilots felt strongly that the EA-500 should not be certified for single- 
pilot operation. Eclipse CEO Rabum appealed this decision under the Customer Service 
Initiative, and senior FAA management reversed the decision. Why? 

RESPONSE: 


FAA test pilots determined that the EA-500 should be certified for single-pilot 
operation, provided certain equipment is available. This determination was made as 
part of the FAA’s finding of compliance with FAR 23. 1 523, “Minimum flight crew”, 
during the type certification process. In making this determination, the FAA used a 
Multi-Pilot System Usability Evaluation (MPSUE) process. The MPSUE included five 
FAA pilots and one FAA flight test engineer. A variety of flight profiles were flown 
with various failures induced to assess crew workload using the Bedford scale. The 
FAA found that the minimiun flight crew for the EA-500 was either a pilot and copilot, 
or one pilot provided certain equipment is available. 

Separate fiom the type certification program, the FAA’s Flight Standardization Board 
(FSB) then evaluated the Eclipse EA-500. The FSB determines aircraft type rating 
requirements and develops the minimiun training requirements used for flight 
crewmember qualification. The FSB determines the operational suitability of the 
aircraft and its systems; requirements for flight crew training aids; type rating 
requirements for pilots; and other items. In its interim summary presented in December 
2006, the FSB briefed a preliminary determination that the EA-500 required a two pilot 
crew to operate safely. However, it is beyond the scope of the FSB to determine 
compliance with the FAR 23.1 523 design standard. The FSB is charged with 
determining the training and other pilot requirements necessary to successfully 
complete a type ride practical test. 

Eclipse communicated its concern with the FSB’s preliminary determination that two 
crew were necessary because such a determination was outside the FSB’s scope. 
However, the FAA found that the proposed Eclipse Aviation training program as 
reviewed by the FSB at the time was inadequate in preparing an applicant to pass a 
single pilot instrument flight rules (IFR) type certification check. The FAA and Eclipse 
subsequently worked together to determine the proper level of training, checking, and 
currency requirements needed to support safe single pilot operations in the Eclipse EA- 
500. 
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53. The largest operator of the EA-500 refiises to operate it with a single-pilot. Numerous 

pilots interviewed in this investigation felt it was very unsafe to operate this aircraft with a 
single-pilot due to its complexity. Please comment. 

RESPONSE: 


The operator referred to in the question is DayJet. Mr. Sabatini confirmed with 
DayJet’s then-presidenl/CEO, Ed lacobucci, that it was always part of DayJet’s 
business plan that they operate with two pilots, regardless of the type of aircraft being 
flown. Consequently, the decision to fly the EA-500 with two pilots instead of one was 
not based on the operational characteristics of the aircraft. 

We cannot speak to individual criticisms of pilots that were spoken with in the course 
of the Committee’s investigation because we do not know who they are or from what 
circumstances their criticisms arose. We are aware of some criticisms from the pilots 
on the Flight Standardization Board who flew the aircraft. We have determined that the 
problems cited resulted from them flying an aircraft that was not compliant with the 
type certificate at the time it was flown. 
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54. You state in your testimony that, "High profile projects always involve a strong and 
dedicated push at the end to meet the negotiated deadline, if possible." Why is there a 
negotiated deadline? Why does the FAA, as a regulatory agency charged with overseeing 
aircraft safety, “negotiate” with carriers that it is supposed to oversee? 

RESPONSE: 


The FAA works with each applicant via a Project Specific Certification Plan (PSCP). 
These plans facilitate the certification program by allowing the FAA and the applicant 
to mutually plan the program milestones based on the available resources. The FAA 
and the applicant discuss the milestones of a certification program and each commit to 
actions. For example, if the applicant wants to begin type inspection authorization 
(TIA) testing by a certain date, then the FAA requires certain data submittals and 
certain actions, such as a conformity inspection, to be completed by a reasonable date 
m advance of the TIA test date, to allow time to review the data and approve or 
disapprove it. These milestones and timeframes are the items which are discussed or 
“negotiated” between the applicant and the FAA. Once the PSCP is signed, each party 
agrees to the schedule and recognizes the implications and is accountable for a missed 
deadline. Rather than using the term “negotiated deadline,” perhaps the word 
“coordinated” would have been a better choice of words. What was intended to be 
conveyed is that the FAA and applicant determine a realistic schedule that both parties 
can support. Such coordination is important for the FAA because it is the only way we 
can effectively and efficiently manage our resoiuees in carrying out our obligations in 
the type certification process. 
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55. Does the FAA have adequate general aviation certification requirements specifically 
designed for very light jets (VLJs)? 

RESPONSE: 


Part 23 of the Federal Aviation Regulations (FARs) contains appropriate minimum 
airworthiness standards for most small airplanes. When we find that a proposed design 
aspect of an airplane contains technology not envisioned by FAR Part 23, we apply any 
necessary additional airworthiness standards through the issuance of special conditions 
per FAR 21.16. We applied such special conditions on the Eclipse type certification 
program. 

The FAA reevaluated the appropriateness of its light jet certification requirements in 
the late 1990’s, as the Eclipse and Safire jets began development. Before the late 
1990’s, the FAA had certified several light jets and had traditionally applied special 
conditions that increased the performance standards. Applying these special conditions 
was consistent with light jet technology at the time, which typically resulted in jets 
having high takeoff and landing speeds (and long takeoff and landing distances) when 
compared to piston-twin-engine airplanes. 

However, as the Eclipse EA-500 design was being developed in the late 1990’s, early 
performance estimates showed that the EA-500’s takeoff and landing speeds and 
distances were actually closer to light piston-twin-engine airplanes than typical 
transport category jets. These performance estimates showed that the FAA’s previous 
assumption on jet performance was outdated and the FAA needed to reevaluate its 
certification standards for jets against existing small airplanes, especially for the lighter 
weight jets. 

After the Eclipse reevaluation, the FAA determined that the appropriate airworthiness 
standards for light jets weighing 6,000 pounds or less (like the Eclipse EA-500) were 
the existing FAR 23 rules for normal category airplanes. These airworthiness standards 
require all mrbine-powered airplanes under 6,000 pounds to meet many of the same 
performance standards for piston twin engine airplanes over 6,000 pounds. 

The FAA determined that the existing airworthiness standards were appropriate and 
sufficient in most areas for the Eclipse EA-500 type certification. However, we did 
find that a few airworthiness standards were inadequate or inappropriate because of 
novel or unusual design features. As a result, we issued certain special conditions, as 
provided for in FAR 21.16, which became part of the certification basis for the Eclipse 
EA-500. 

In 2003, an Aviation Rulemaking Committee (ARC) was formed to review the 
certification and operational requirements for small jets. The group reviewed normal 
and commuter category airworthiness standards, as well as existing special conditions. 
The ARC recommended modifying 41 existing Part 23 rules. Most of the 
recommendations are based on the current special conditions applied to Part 23 jets. 
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In addition, one of the Special Certification Review (SCR) team’s recommendations 
was for the FAA to reevaluate the criteria for applicability of function and reliability 
(F&R) testing. We agree with this recommendation and have already implemented a 
solution. We had already developed a generic issue paper to apply F&R testing 
requirements to turbojets weighing less than 6000 pounds. We are currently applying 
F&R requirements, via special condition, on two active projects: the Diamond D-Jet 
and the Cirrus jet. We will continue to have internal discussions to determine if a rule 
change to FAR 21.35 requiring F&R testing for turbojet powered airplanes less than 
6000 pounds is appropriate. 
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U.S. Department 
of Transportation 

Federal Aviation 
Administration 


November 4, 2008 


The Honorable John L. Mica 

Ranking Republican Member 

U.S. House of Representatives 

Committee on Transportation and Infrastructure 

2 1 65 Rayburn House Office Building 

Washington, DC 205 1 5 

Dear Mr. Mica: 

Attached please find responses to questions for the record for the September 1 7, 2008 hearing 
on “FAA Aircraft Certification: Alleged Regulatory Lapses in the Certification and 
Manufacture of the Eclipse EA-500,” sent by you on behalf of Congressman Robin Hayes. 

We apologize for the delay in responding, and thank you for your understanding. 

Sincerely, 

Maty U. Walsh 
Assistant Chief Counsel 
For Legislation 

Enclosure 


cc: The Honorable Robin Hayes 
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September 17, 2008 
Subcommittee on Aviation 
Hearing on 

“FAA Aircraft Certification: 

Alleged Regulatory Lapses in the Certification and 
Manufacture of the Eclipse EA-500” 

Questions for the Record 
From Congressman Robin Hayes 
and 

Congressman John L. Mica 
To 

The Honorable Robert Sturgell 
Acting Administrator 
Federal Aviation Administration 


Is the EA-500 a safe airplane? 

The FAA issued the Type Certificate (TC) for the EA-500 airplane on September 
30*, 2008. The FAA will only issue a TC once the applicant (Eclipse in this case) 
has shown compliance to the applicable standards and the aircraft has no feature or 
characteristic that makes it unsafe for its intended use. 

The FAA chartered a Special Certification Review Team (SCR Team) to evaluate 
specific issues of compliance on the type certification. This team conducted its review 
between August 11, 2008 and September 12, 2008. The SCR Team concluded the 
aircraft met the applicable requirements for a type certificate. 

The FAA has always contended that the aircraft met the applicable standards and is 
safe for operation. 
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In retrospect, what, could have been done differently? 

The FAA as well as the SCR Team found that certain aspects of the project management 
could have been more comprehensive. Specifically, commonly used FAA internal 
communication processes, such as issue papers or policy memorandums to provide 
guidance to the project team, were not used consistently to document means of 
compliance. Additionally, communication between the team and other FAA 
organizations could have been enhanced to allow a smoother transition firom the 
certification of the aircraft design to the operational certification. Finally, the FAA could 
have better ensured that appropriate technical disciplines were assigned during the critical 
phases of the project. 

The FAA is undertaking an effort to review om internal procedures to assure that 
communication within the team and other organizations within the FAA can be 
strengthened. 
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Why did it take five years to certify the Eclipse 500? How tong should it take? 

The normal timeframe for the certification of an aircraft under Federal Aviation 
Regulations Part 23 is 3 years from the date of application. This is an acceptable amount 
of time for a typical general aviation aircraft. 

The 5 years taken to complete the certification of the EA 500 was due to a number of 
factors. One factor being that the EA500 is an advanced technology, highly integrated 
aircraft. Another factor which contributed to the large portion of the delay in the 
certification schedule was the company’s decision to change from the Williams engine to 
a Pratt and Whitney engine, approximately 18 months into the program. Considering the 
integration of the systems with the aircraft, the certification program schedule was 
dependant on having the airframe/power plant configuration established. The first flight 
initially occuired with the Williams engine in August of 2002. The change to the Pratt 
and Whimey Engine came in February 2003. The first flight with the Pratt and Whiney 
engine occurred in December 2004. At this point, the program had been on-going for 
over 3 years. The certification program for the new Pratt and Whitney engine itself also 
had to be accounted for in the Eclipse Certification Schedule. 
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The process of delegation and alternative means of compliance is set up to recognize 
the size, complexity and maturity of the industry organization being regulated and 
certified. In your view is this an appropriate way to see that safety is improved as 
technology improves? 

The FAA considers delegation as appropriate and necessary for assuring that the FAA 
can continue to maintain and improve the safety of the aviation fleet. Delegation is a key 
component which supplements and aids the FAA workforce. This system is a long 
standing, sound, and well-established system, which enables the FAA to focus on the 
safety critical areas, while using delegation to support our workforce on the day-to-day 
tasks related to certification. 

In the certification process, “different” regulatory methods of compliance, i.e. alternative 
means of compliance, achieve same or equivalent levels of safety for the certificated 
product. These alternative means of compliance are an important safety tool for the 
Aircraft Certification Service and are instrumental in the certification of new, innovative 
aircraft designs, as well as in the achievement of advancement in aviation technology. 
These different methods provide the FAA and the manufacturer a mechanism to show 
compliance, and obtain the required level of safety, for certification of aircraft 
components for which there may be no suitable certification process enumerated in the 
regulations. 
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Some have characterized “alternative means of compliance” as a “loophole”. Is that a 
fair and correct representation? Can you characterize the negative effects to aviation if 
such alternate means of compliance were not allowed? 

The term “alternate means of compliance” or “AMOC” is a way to show compliance 
differently from the normal or established maimer. To add some clarification, an AMOC 
is associated with an airworthiness directive (AD). The AD is a regulatory requirement 
that defines specific actions that the owner/operator must take within a specific timeframe 
to address an unsafe condition. Compliance via an FAA approved AMOC provides the 
same level of safety as compliance per the method outlined in the AD. 

AMOCs for ADs are an essential aspect of safety management and are necessary for a 
variety of reasons. For example, specific airplanes may have incorporated modifications, 
alterations, or repairs that make compliance with AD procedures impossible. In such 
cases, the AMOC process allows owner/operators to devise an alternative method of 
addressing the unsafe condition. Without the AMOC process, an owner/operator could 
be unable to comply with the procedures specifically outlined in the AD, would not be 
able to propose a different method of compliance and the airplane would be grounded. 

Like the use of AMOCs for ADs, the FAA has a variety of means to show 
compliance with the airworthiness standards during type certification projects, 
including special conditions, equivalent level of safety (ELOS) findings, and 
exemptions. All of these examples, plus the options outlined in 14 CFR §21.305, are 
legally defined options for establishing appropriate certification standards and for 
showing compliance. If these options were not in place, the FAA would not have the 
ability to establish certification standards or accept appropriate compliance 
demonstrations and would hamper the implementation of technology that increases 
aviation safety. 
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Mr. Chairman and Members of the Subcommittee: 

We appreciate the opportunity to testify today regarding the Eclipse EA-500 very 
light jet. Our testimony today is based on the initial results of our investigation of the 
Federal Aviation Administration’s (FAA) process used to certify the EA-500. It is 
important to emphasize that we did not assess the safety of the aircraft itself. Further, 
our investigation was limited to the Eclipse certification only; we did not examine 
FAA’s process for certifying and overseeing the aircraft manufacturing industry in 
general. 

As this Subcommittee is aware, safety is a shared responsibility among FAA, aircraft 
manufacturers, airlines, and airports. Together, these form a series of overlapping 
controls to keep the system safe. The United States has achieved an impressive safety 
record — a remarkable accomplishment given all the changes occurring within the 
industry. 

Over the past several years, multiple manufacturers have been designing a new class 
of aircraft called very light jets or VLJs. VLJs are small aircraft with advanced 
technologies that cost less than other 
business jets. Aviation forecasters predict 
that thousands of VLJs will enter the 
National Airspace System over the next 
2 decades. 

Experts also predict that VLJs will be 
targeted towards private general aviation 
users as well as on-demand, point-to-point 
air taxi operators. In 2006, FAA certified 
the first VLJs — one of which was the 
Eclipse EA-500, a six-seat jet aircraft, which featured advanced avionics and better 
fuel efficiency. Eclipse Aviation was formed in 1998 with the intent of introducing 
new technology to the aviation industry. 

When a manufacturer embarks on building a new aircraft, it must receive two separate 
approvals from FAA before the aircraft can be mass produced: (1) a design 
certification (approving the design of the aircraft) and (2) a production certification 
(approving the manufacturer to begin mass production of the aircraft). FAA issued 
the design certificate for the Eclipse EA-500 on September 30, 2006, and the 
production certificate on April 26, 2007. It is important to note, however, that even 
after a manufacturer has received certification approval, FAA is responsible for 
ensuring that each aircraft manufactured under its design certificate meets the 
approved design and is in condition for safe operation. 
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While the industry was generally excited about the introduction of the technologically 
advanced jet, some FAA employees were concerned that it was “pushed through” the 
certification process too quickly. In March 2007, our office received a complaint 
concerning the certification process for the Eclipse EA-500. The complainant alleged 
that senior FAA officials prevented FAA inspectors from properly inspecting the 
production of the Eclipse jet by, among other things, reassigning the inspectors who 
had identified numerous deficiencies with the aircraft’s production and prohibiting the 
new inspection team from looking under the aircraft floorboards during final 
inspection. 

During our ongoing investigation of the allegations, other FAA employees raised 
additional concerns that senior officials in FAA’s Aircraft Certification Service short- 
cut both the design and production certification processes. The complaints alleged 
that those officials may have compromised safety by (1) certifying Eclipse’s design 
despite knowledge of Eclipse’s failure to meet certification requirements for avionics 
software, stall warnings, flaps, and cockpit screens and (2) rushing approvals required 
for Eclipse to mass produce its jet. 

Mr. Chairman, a significant issue overshadowing FAA’s certification of the EA-500 
is the inherent risks associated with a new aircraft utilizing new technology, produced 
by a new manufacturer, and marketed with a new business model for its use. Because 
of these factors, we would have expected FAA to exercise heightened scrutiny in 
certifying the aircraft. In addition, because the EA-500 has advanced avionics and 
turbine engine technology typical of large transport aircraft combined with the light 
weight of smaller, private aircraft, it did not easily fit into FAA’s existing certification 
framework. 

FAA chose to certify the EA-500 and other VLJs using certification requirements for 
general aviation aircraft rather than the more stringent certification requirements for 
larger transport aircraft. However, in a post-design certification, “lessons-learned” 
internal review of the Eclipse project, FAA managers acknowledged that the general 
aviation certification requirements were “inadequate to address the advanced concepts 
introduced on this aircraft,” We understand that FAA is developing a Notice of 
Proposed Rulemaking (NPRM) to clarify certification requirements for VLJs. Given 
the issues surrounding the EA-500 certification, FAA should expedite the NPRM to 
allay future concerns with this expanding industry segment. 

In certifying the EA-500, FAA asserts that it met all pertinent certification 
regulations. However, our initial investigation results show a combination of FAA 
actions and inactions indicating that the Agency expedited the certification processes 
for the EA-500 to meet a September 2006 deadline in the Aviation Safety line of 
business fiscal year (FY) 2006 Performance Plan. 
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Specifically, FAA allowed Eclipse to use alternate means of compliance to meet 
design certification requirements despite unresolved design problems identified 
during testing. Those alternate actions may have contributed to problems that are still 
reported by Eclipse users today. FAA also awarded Eclipse a production certificate 
even though there were known deficiencies in its supplier and quality control systems. 
In addition, the company experienced significant problems replicating its approved 
design. We are also concerned that the priority designation of the EA-500 may have 
affected FAA’s relationship with and oversight of Eclipse as it quickly moved this 
new aircraft through the certification process. 

My remarks today will focus on the three following points. 

FAA Allowed Eclipse To Use Alternate Means of Compliance To Meet Design 
Certification Requirements Despite Unresolved Design Problems — Users Continued 
To Report Similar Problems After Certification 

During the design certification of the EA-500, Eclipse applied and FAA approved 
alternate means of compliance for the aircraft’s avionics software and airspeed and 
altitude indicator (pitot-static system). More importantly, recent events reported by 
Eclipse aircraft users indicate that other problems identified during the design 
certification continued after the design was approved, including erroneous stall 
warnings, cockpit display failures, and flap movement problems. Further, users are 
still reporting that the aircraft is experiencing a high rate of tire failure. 

In addition, our analysis of two safety problem reporting systems disclosed numerous 
issues similar to those encountered during the design certification process; many of 
these problems have been reported with the EA-500 over the last year. For example, 
Service Difficulty Reports (SDRs)' disclosed that between June 2007 and July 2008, 
the largest user of the EA-500 submitted 84 SDRs for 28 Eclipse aircraft. While 
SDRs are to be expected with any new aircraft, the fact that many of those reported 
for the EA-500 appear to relate back to design issues is troubling. 

A recent incident involving the EA-500 has heightened attention regarding the 
aircraft’s design certification. On June 5, 2008, an EA-500 on approach to Chicago 
Midway airport experienced a throttle failure that resulted in an uncontrollable 
maximum power thrust from its engines. After consulting the emergency procedures, 
the pilots shut down one of the engines; however, this action caused the second 
engine to roll back to idle power and be unresponsive to the throttle. The pilots 
declared an emergency and were able to land the plane without injury to the two pilots 
or two passengers. 

During its investigation into the incident, the National Transportation Safety Board 
(NTSB) expressed concern about the reliability of an assembly that failed after 


^ SDRs are submitted by operators when a failure or defect occurs in the aircraft structure or is detected if that failure or 
defect has endangered or may endanger the safe operation of an aircraft. 
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accumulating only 238 hours and 192 cycles. The NTSB also raised concerns that the 
problem could be due to flaws in the design logic for the software that controls the 
engines and issued two recommendations to FAA requiring (1) immediate inspection 
of all EA-500 engine throttles and (2) an emergency procedure to address dual engine 
control failure. 

On Jime 12, 2008, FAA issued an Airworthiness Directive (AD)^ that requires 
operators to examine throttle controls for identified faults and replace assemblies as 
necessary. Since awarding the design certificate to Eclipse, FAA has issued a total of 
six ADs for various components of the EA-500. 

As a result of this incident, FAA engineers re-examined the software that controls the 
engines and discovered software logic flaws that should have been resolved before 
design certification. At the end of June 2008, the local FAA certification manager 
sent a memorandum to the manufacturer requiring Eclipse to develop an approach to 
bring the aircraft design into certification compliance for that system. Eclipse is 
currently addressing FAA’s requirement. 

FAA Awarded Eclipse a Production Certificate Despite Known Deficiencies in the 
Company’s Supplier and Quality Control Systems 

FAA granted Eclipse a production certificate on April 26, 2007. A production 
certificate is FAA’s approval that the manufacturer has demonstrated the ability to 
manufacture aircraft using an FAA-approved design without further FAA 
airworthiness inspections. To obtain a production certificate, however, manufacturers 
are required to undergo FAA quality control reviews and an FAA Production 
Certification Board review to determine if they have complied with all regulations. 
FAA’s quality control reviews, which began in July 2006, identified 
numerous deficiencies, with 42 serious deficiencies (including 4 involving software) 
identified as late as February 2007. 

The Production Certification Board completed its review on April 26, 2007 — the 
same day the production certification was granted — and identified two serious, 
overarching deficiency issues. First, the Board found that Eclipse had not completed 
the requirement to show that it had established and could maintain a quality control 
system. Second, the Board found significant issues associated with Eclipse’s controls 
over its suppliers. Despite the impact that these issues could have on the production 
process, FAA awarded the production certification to Eclipse with 13 specific 
production problems. 

Additionally, before it received its production certification, Eclipse encountered 
numerous problems replicating its own aircraft design on the factory floor. A 
significant concern was that manufacturing deficiencies were not identified by Eclipse 


^ FAA issues an Airworthiness Directive when it finds that an unsafe condition exists and that the condition is likely to 
exist in other products of the same design. 
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inspectors designated to certify aircraft airworthiness. For example, in one instance. 
Eclipse presented an aircraft to FAA for airworthiness certification with 
approximately 20 airworthiness deficiencies, even though an FAA-approved Eclipse 
inspector had previously inspected the aircraft for airworthiness and found no non- 
conformities. 

FAA’s Desire To Promote the Use of VLJs May Have Contributed to Its Decision To 
Accelerate the Eclipse Certification Process 

A significant concern surrounding this issue, Mr. Chairman, is that FAA designated 
the Eclipse EA-500 VLJ as a priority project for certification in its FY 2006 
Performance Plan for the Aviation Safety line of business. In this plan, FAA stated 
that it would certify the aircraft design by September 2006. Although FAA met this 
deadline, the specific designation as a priority certification may have resulted in 
reduced vigilance on the Agency’s part during the aircraft’s design and production 
certification processes. We identified four other FAA actions that raise concern 
regarding the Agency’s safety oversight focus in this matter: 

• FAA granted Eclipse Organizational Designated Airworthiness 
Representative (ODAR) authority to certify its own aircraft for airworthiness 
4 years before Eclipse obtained a design certificate. This authority allowed 
Eclipse to approve and document parts as they were manufactured, with Eclipse 
inspectors overseeing manufacturing processes on FAA’s behalf However, it is 
unclear to us why FAA determined that Eclipse met the qualifications to perform 
its own inspections since Eclipse was a new manufacturer with no history of 
manufacturing an aircraft or shepherding a design through the design certification 
process. Further, FAA inspectors found numerous deficiencies on planes that had 
been accepted and approved by Eclipse inspectors. 

• FAA granted single-pilot operation certiHcation for the EA-500 despite FAA 
Flight Standardization Board^ concerns. Eclipse originally envisioned that the 
EA-500 would be marketed to individual owners. However, because of the many 
m-flight problems reported by pilots, the Board determined that the aircraft 
required a two-pilot crew. On December 15, 2006, Eclipse imtiated a customer 
service complaint to protest the Board’s recommendation. FAA subsequently 
rescinded the two-pilot recommendation on January 29, 2007. 

• FAA replaced the inspection team that had identified deflciencies at Eclipse 
and restricted the new team’s inspection activities. After FAA removed the 
original inspection team, it assigned the former FAA Headquarters Deputy 
Director of Aircraft Certification responsibility for the Eclipse certification 
project. This individual assembled a new team of inspectors and developed a 


’ Ttie FAA Flight Standardization Board is a group of FAA pilots who test-fly the new aircraft to determine readiness for 
users. 
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policy that limited the inspectors’ ability to fully inspect the aircraft for 
airworthiness. 

• FAA allowed one of its engineers formerly assigned to the Eclipse project to 
take a high-level position at Eclipse without a “cooling-off” period. While at 
FAA, the engineer evaluated and approved Eclipse’s proposed methods for 
meeting FAA’s certification requirements for the design phase of the aircraft. 
When he left FAA, he immediately began working at Eclipse as Director of 
Certification, serving as the focal point between Eclipse and FAA concerning the 
company’s compliance with FAA’s certification requirements. 

Mr. Chairman, the results of our investigation and those of the NTSB, as well as 
concerns expressed by EA-500 users and FAA employees, clearly underscore the 
need for FAA to take immediate actions to ensure that existing problems reported by 
Eclipse users are quickly resolved. At our recommendation, FAA established a 
Special Certification Review Team last month to verify that Eclipse corrects design 
and production problems associated with the EA-500 and determine that the aircraft is 
in condition for safe operations. The team concluded the certification of the EA-500 
was appropriate because it met FAA requirements for the focus areas reviewed. We 
received a copy of the team’s report on Saturday and are reviewing its findings and 
recommendations. 

However, based on our interim results, we are recommending that FAA take several 
immediate actions. Those include expediting its NPRM to clarify certification 
requirements for the expanding VLJ industry segment; refraining from granting new, 
inexperienced manufacturers authority to certify the airworthiness of their own 
aircraft prior to design certification; and verifying that the certification process for 
single-pilot operations of the EA-500 was appropriate. 

I would now like to discuss these issues in further detail. 
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FAA Allowed Eclipse To Use Alternate Means of Compliance To 
Meet Design Certification Requirements Despite Unresoived 
Design Problems — Users Continued To Report Similar Problems 
After Certification 

We found that in certifying the EA-500 design, Eclipse used and FAA approved an 
alternate means of compliance. While FAA regulations permit alternate means of 
compliance, we are particularly concerned that FAA applied a less stringent standard 
to the avionics software design, which the aircraft heavily relies upon for operation. 
Users have since reported problems directly related to the EA-5(X) software, such as 
cockpit display failures. In addition, other problems with the aircraft design have 
surfaced, such as airspeed and altitude indicator (pitot-static system) discrepancies, 
erroneous stall warnings, and tire failures. The timeline below shows key dates 
leading up to the design certification for the EA-500. 


Figure 1. Eclipse Design Certificstion 
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^ First article inspection: A required inspection of a newly produced or revised part, assembly, or product, 

^ Provisional design certification; An approval of the aircraft design that allows for limited flight and operational 
testing of the aircraft. 

Source: OIG analysis of FAA data 


The Eclipse EA*500 relies extensively on software to operate. The Eclipse EA-500 
is a technologically advanced aircraft with an integrated avionics system that controls 
several of the aircraft’s crucial systems and displays, sensor data processing, and 
subsystem monitoring. For example, this system enables the flight crew to control 
landing gear, cabin pressurization, lighting, trim, and electrical systems. 


This integrated system also handles key data that flows to the aircraft’s flight 
management system, such as global positioning (GPS), altitude, direction, and 
velocity data. The EA-500’ s avionics system is solely computer-based; it does not 
have stand-by instruments to monitor flight-critical information (other VUs like the 
Cessna Mustang have back-up [analogue] systems; see figure 2 below). 
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! e C’o npArison of Cossna and EdMpse Cockpit Systems 


Cessna Mustai^ cockpit has analogue instrumentation 
(gauges) in addition to a computer screen display 


£A>500 cockpit relies exclusively on a computer-based 
system 


During the EA-500 design certification. Eclipse applied and FAA approved alternate 
means of compliance for the aircraft’s avionics software. Given the EA-500’ s 
dependence on its avionics software, we would have expected FAA to perform 
rigorous analysis and testing prior to design certification. We found, however, that 
FAA did not require this software to be approved to the accepted industry standard 
before certification. Instead, FAA accepted an “lOU” from Eclipse, which stated that 
the aircraft would meet the accepted industry standard at a later date. In exchange. 
Eclipse agreed to maintain control of the aircraft — meaning that it would not be 
released to customers. 

While FAA guidance concerning this process allows for deviation from normal 
accepted practices, we are concerned about the level of review that FAA conducted in 
certifying the software. Specifically, FAA Advisory Circular 20-1 15B states the 
following: 

An applicant for an [FAA design certification] for any electronic equipment or 
systems employing digital computer technology may use the considerations 
outlined in RTCA document DO-178B [industry standards] as a means but not 
the only means to secure FAA approval of the digital computer software. 

FAA software technical specialists we spoke with told us that the RTCA document 
was essentially the “de-facto standard” for software approval. We also spoke with 
FAA inspectors (who routinely approved aircraft software applications) who stated 
that FAA’s proposed actions of accepting an lOU from the manufacturer were so 
contrary to its long-established business practices that they did not meet the safety 
standards normally required of other applicants. 


The lOU from Eclipse addressed tests that its software supplier needed to complete to 
meet industry standards for the software driving the avionics system. However, when 
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FA A issued the design certificate. Eclipse’s software supplier had only completed 
23 of the 65 tests. The supplier subsequently completed all 65 tests by June 2007; 
however, EA-500 users continued to report problems with the cockpit instrumentation 
as recently as May 2008. For example, our analysis of SDRs submitted between June 
2007 and July 2008 by the largest user of the EA-500 shows 22 malfunctions of the 
instrument display, including faulty airspeed readings that caused aborted take-offs 
and autopilot malfunctions. 

In a post-design certification, “lessons-leamed” internal review of the Eclipse project, 
FAA managers acknowledged that “FAA supported flight testing without completing 
software validation” even though Eclipse had a “significant software vendor 
integration issue.” This review also noted that “FAA created innovative processes to 
support [the] program [but] there are risks associated with not following documented 
processes.” 

In fact, even the local FAA manager who approved the Eclipse design certification 
has since expressed concerns over the process used for certifying the aircraft software. 
In a July 16, 2007, memorandum to the Director of the Aircraft Certification Service 
this manager stated the following: 

During the TC [design certification], we accepted a lesser level of validation and 
consequently the FAA ended up doing a great deal of developmental flying with 
Eclipse, a task that the company should accomplish prior to FAA TIA 
[preliminary aircraft] testing. In conducting a lessons learned review after the 
initial TC [design certification], we identified the level of software certification as 
an issue we would treat differently on subsequent certifications. 

A specific concern related to the avionics software was that the cockpit screen 
was blanking or freezing both before and after design certification. FAA 

regulations state that the electronic display indicators must be designed so that if one 
display fails, another display would remain available to the crew without the need for 
immediate action by the pilot for continued safe operation. The cockpit display is 
critical instrumentation for the pilot; it displays vital information such as airspeed, 
altitude, flap position, and rate of climb. In the case of the EA-500, the cockpit 
display is even more critical because there is no back-up, analogue instrumentation. 

In order to award the design certificate, FAA permitted Eclipse to fix the software 
“bug” that caused the screen blanking after the design certification was issued. 
However, Eclipse was not able to do so until January 18, 2007 — nearly 4 months after 
the design certification was awarded. While this fix appeared to address the software 
“bug,” our analysis of SDRs reported by the largest user of the EA-500 between June 
2007 and July 2008 disclosed one instance of cockpit screen blanking that occurred 
during the final approach for landing. 
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During the design certification process for the EA-500, Eclipse applied and FAA 
approved alternate means of compliance to certify the aircraft’s system that 
controls airspeed and altitude indicators. The Eclipse EA-500 design for the pitot- 
static system (which indicates airspeed, altitude, and rate of climb) did not include a 
drainage system for excess moisture, unlike the typical design for other aircraft. 
Eclipse developed and initially tested the EA-500 pitot-static system and reported no 
early significant problems. However, it is important to note that this initial testing 
took place in Albuquerque, New Mexico — ^an extremely dry climate with little 
rainfall. Once the aircraft was brought into more humid climates, such as Florida, 
problems began occurring with airspeed and altitude cockpit indicators. 

The source of these problems was eventually traced to moisture build-up inside the 
pitot-static system. This occurred due to the unusual placement of the static ports on 
the top of the aircraft nose (see figure 3 below) and the lack of drainage; the static 
ports are normally located on the sides of the aircraft to mitigate moisture. 

Figure 3. EA-500 Nose Pitot-Static Ports 



Source: OIG 


Federal aviation regulations require that “the design and installation of each air speed 
indicating system must provide positive drainage of moisture from the pitot-static 
system.” However, FAA can approve a non-typical design by granting the 
manufacturer an “Equivalent Level of Safety” (ELOS) exemption. In this instance, 
FAA granted an ELOS for the EA-500 pitot-static tube as proposed by the 
manufacturer. The ELOS was based on Eclipse’s assertion that the pitot-static system 
included a heating system designed to dry any moisture that might accumulate. 

According to FAA inspectors we spoke with at the Fort Worth FAA certification 
office (the office responsible for Eclipse certification), they were uncomfortable that 
the pitot-static design lacked sufficient drainage and declined to approve the ELOS, 
even with the heating system. To overcome these objections, FAA referred the ELOS 
approval to the Kansas City Small Airplane Directorate, which agreed to approve it. 
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In response to the pitot-static system problem, FA A issued an AD on June 14, 2007, 
limiting operations of the aircraft to two-pilot operations only and only under visual 
flight rule conditions.'* FAA issued a second AD that was effective on 
February 26, 2008. This AD lifted the restrictions for those aircraft whose owners 
had installed the design modification for the pitot-static system developed by Eclipse 
for existing aircraft. However, users we spoke with told us that while the 
modification required by the AD has helped reduce the number of incidents, it has not 
eliminated the problem. 

For example, as recently as April 2008, the pilot of an EA-500 experienced a warning 
signal that the two instruments measuring airspeed did not agree during take-off. The 
pilot then aborted the take-off and returned the aircraft for maintenance inspection. 
Subsequent inspection of the aircraft revealed moisture build up in the pitot-static 
system; after draining out the moisture, the aircraft returned to normal service without 
problems. 

Eclipse aircraft users continued to report other post-design certification 
problems with the EA-500, including erroneous stall warnings, flap movement 
failures, and a high rate of tire failure. 

• Erroneous Stall Warnings : The EA-500 experienced erroneous stall warnings 
before and after the design certificate was awarded. FAA regulations state 
“. . . the stall warning must not occur during takeoff with all engines operating, a 
takeoff continued with one engine inoperative, or during an approach to landing.” 
These stall warnings continued to occur after Eclipse received its design certificate 
on September 30, 2006. According to FAA pilots we spoke with, erroneous stall 
warnings can be extremely hazardous, particularly when landing. For example, 
they may cause pilots to either take urgent actions that can prove dangerous based 
on the belief that they are experiencing a stall or ignore them because they have 
proven to be erroneous in the past. 

Nearly 3 months after the design certification was issued, FAA was able to 
attribute some of the stall warnings to flying the aircraft at inappropriate speeds. 
However, pilots have recently reported this problem with the EA-500 through 
SDRs and a voluntary, anonymous safety reporting system, the Aviation Safety 
Reporting System. At least three additional reports regarding stall warnings have 
been reported through these two systems between June 2007 and July 2008. All 
three involved problems on take-off. 


^ Flying under visual tlight rules (VFR) requires that the pilot (or pilots) have enough forward visibility and clearance from 
clouds to safely operate the aircraft without referring to cockpit instruments. 
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• Flap Movement Failures : FA A regulations state that the main wing flaps must be 
designed so that the occurrence of flap failure is “extremely improbable.” 
Flowever, both before and after the design certificate was awarded, the aircraft had 
problems with flaps sticking in position. The impact of this on the aircraft is that a 
“flaps up” landing can require up to 100 percent more landing distance. This 
landing length may not be available for every general aviation pilot who flies the 
EA-500, which is not equipped with anti-skid brakes. During testing of the 
aircraft in December 2006, FAA’s Flight Standardization Board recommended 
that it be restricted to two-pilot operations stating: 

The immediate issue that has caused the Board to reach this conclusion 
is the repeated flap failures that have occurred during recent flights. 

These failures are now approaching a frequency of one flap failure for 
every 10 attempts to operate the flaps. The flight control problem 
affects safety of flight and acceptable operational reliability. 

FA A Headquarters officials overruled the Board’s recommendation and approved 
it for single-pilot operations in January 2007 after receiving a customer service 
complaint from Eclipse. While only 1 instance of flap failure was reported 
through an SDR after design certification, our analysis of SDRs from the largest 
EA-500 user between June 2007 and July 2008 disclosed 21 reports of other flight 
control part malfunctions (i.e., rudder, flaps, aileron, and elevator). 

• High Rate of Tire Failure: During our site visits to the largest user of the EA-500, 
pilots we spoke with raised other issues that were not identified during the design 
certification of the aircraft. For example, they expressed concerns about a high 
frequency of tire failure associated with the aircraft. In subsequent discussions 
with these and other EA-500 users, they told us that the high rate of tire failure 
was likely due to the fact that the aircraft was initially designed for use on “soft 
fields” (i.e., dirt and grass). However, it is now being used almost exclusively on 
standard, paved airport runways. 

Since the tires were meant for soft field use, they are softer and less durable than 
the harder, longer-lasting aircraft tires commonly used on standard, paved 
runways. As a result, the aircraft requires an even higher degree of speed control 
and precision upon landing to prevent tire “blow-outs” during landing, which 
places additional workload on the pilots. Because pilots continued to report tire 
failures with the EA-500, Eclipse has submitted the required data to FAA to obtain 
certification for a more durable tire. 

Pilots also expressed concerns that the tires on the aircraft were wearing 
excessively because the landing gear was designed with a slight inclination 
inwards, towards the fuselage. As a result, the entire surface of the tires was not 
contacting the runway evenly, thus causing excessive wear on the exposed sides of 
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the tires. We understand that Eclipse is modifying the aircraft’s design to correct 
this problem. 

According to FAA, none of the problems experienced by users today were 
identified during the design certification. FAA asserts that none of the current 
problems experienced by EA-500 users were identified during the design certification. 
However, in our opinion, there is sufficient evidence that these problems were 
occurring during that period and that FAA should have known about them. 

For example, in the 2 weeks preceding award of the design certification on 
September 30, 2006, Eclipse test-flew the aircraft for 100 hours as a pre-condition for 
receiving the certification. During those flights, the pilots experienced (1) at least 
4 erroneous stall warnings during landing, (2) 10 instances of cockpit screen freezing 
or blanking, and (3) 18 cases of actual flap failure or flap-failure messages on the 
cockpit display. All of these are problems that users continued to report after design 
certification. Table 1 shows the design problems that occurred before and after FAA 
awarded Eclipse its design certification. 


Table 1. Eclipse EA-500 Design Discrepancies Found 
Before and After Design Certification 


! Issue Found'^ 

Pre-Desien Certification 1 

Post-Desien Certifit 

.ation 

Joint FAA & 
Eclipse Flight 
Testing^ 

Flight 

Standardization 

Board* 

Flight 

Standardization 

Board 

Service 

Difficulty 

Reports 

Aviation 
Safety Reporting 
System 

Erroneous 

Stall 

Warnings 

4 

9 

10 

2 

1 

Screen 

Blanking 

10 

2 

None 

Documented 

1 

None Documented 

Flap 

Malfunctions 

18 

None 

Documented 

8 

1 

1 

Airspeed 

Disagrees 

1 

None 

Documented 

None 

Documented 

13 

2 

Air Data 

Computer 

Failures 

20 ' 

1 

None 

Documented 

1 

1 ' 

1 

None Documented 

Autopilot 

Failures 

7 

None 

Documented 

None 

Documented 

3 

2 


\a Number of instances based on documentation obtained currently; more instances may exist. 

\b Joint FAA & Eclipse Flight Testing accomplished by Aircraft Certification Office (AGO) Pilots; Flight 


Standardization Board testing conducted by separate group of FAA pilots. 
Source: OIG analysis of FAA data 


Based on the results of our investigation to date, the conclusions in FAA’s lessons- 
leamed review, and — most importantly — the problems that continue to impact pilots, 
we believe that FAA should have exercised greater diligence in certifying the EA-500 
design. Going forward, FAA must ensure that the approval of aircraft involving so 
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many unknowns (e.g., new technology and new manufacturer) is subjected to close 
scrutiny and thorough risk analysis. 

Last month, at our recommendation, FAA established a Special Certification Review 
Team to verify that Eclipse corrects design and production problems associated with 
the EA-500 and determine that the aircraft is in condition for safe operations. The 
team completed its assessment last week and concluded the EA-500 met applicable 
certification requirements for the issue areas reviewed. We received a copy of the 
team’s report on Saturday and are reviewing its findings and recommendations. 

FAA Awarded Eclipse a Production Certificate Even Though It 
Knew of Deficiencies in Eciipse’s Quality Control and Supplier 
Control Systems 

FAA granted Eclipse a production certificate on April 26, 2007. A production 
certificate is FAA’s approval to manufacture aircraft using an FAA-approved design. 
Prior to obtaining a production certificate, every aircraft manufactured by Eclipse was 
required to receive an FAA inspection and certificate of airworthiness before it could 
be released to a customer. Once Eclipse received its production certificate, however, 
it could mass produce and certify its own aircraft for airworthiness without FAA 
inspection approval. 

Before receiving a production certificate, manufacturers are required to undergo two 
steps: (1) FAA quality control audits and (2) an FAA Production Certification Board 
review. Once FAA completes its quality control audits and the manufacturer has 
corrected all findings, FAA will convene the Board to consider a manufacturer’s 
application for production certification. The purpose of this review is to determine if 
the manufacturer has complied with all regulations required to obtain a production 
certificate. 

A key issue for the Board is to ensure that corrective actions for any non-satisfactory 
conditions of non-compliance have been addressed prior to issuing a production 
certificate. In the case of the EA-500, however, we found that FAA issued the 
production certification before Eclipse corrected identified deficiencies. Further, 
FAA audits of Eclipse supplier controls, which were conducted post-production 
certification, found that significant deficiencies continued to occur. 

Beginning in July 2006, FAA safety inspectors who specialize in aircraft 
manufacturing conducted three quality control audits of Eclipse. Each of these audits 
identified numerous deficiencies, including improperly manufactured parts and 
uncalibrated, unmarked tools. For example, one review conducted by FAA in 
February 2007 identified 42 deficiencies, including 4 involving software used for 
aircraft operations (e.g., pilot displays). 
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On April 10, 2007, when the Production Certification Board was convened, only 29 of 
the 42 deficiencies identified in FAA’s quality control audits had been corrected. 
Despite the 13 uncorrected deficiencies, the Board finalized the on-site (in New 
Mexico) portion of its review of Eclipse quality control on April 12, 2007. 

On April 21, 2007, the Board arrived in Japan to review one of Eclipse’s foreign 
suppliers. It completed this portion of the review on April 26, 2007 — the same day 
that FAA awarded Eclipse its production certification. When the Board finalized its 
review and transmitted its findings to Eclipse on May 21, 2007, (almost a month after 
Eclipse had the production certification) it identified two serious, overarching non- 
conformities with Eclipse production. 


First, the Board concluded that Eclipse had not completed the requirement to show 
that it had established and could maintain a quality control system. Second, based on 
its review in Japan, the Board concluded that Eclipse had significant issues with 
control over its suppliers. 


Despite the impact that these non-conformities could have on the production process, 
FAA awarded the production certification to Eclipse on April 26, 2007, with a total of 
13 known, umesolved production problems (primarily associated with Eclipse 
supplier and quality control systems). The Board did not close out its open review 
items until February 2008. The following timeline shows key dates leading up to the 
production certification for the EA-500. 


Figure 4. Eclipse Production Certification 
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Source: 0!G analysis of FAA data 


Three months after FAA issued the production certification, the 13 unresolved 
action items remained open. We are concerned because FAA was aware of 
unresolved deficiencies that continued after it granted Eclipse its production 
certification. In a July 16, 2007, memo to the Director of Aircraft Certification, the 
local certification office manager stated the following: 
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Thirty-two airplanes have received Standard Airworthiness certificates. 
Twenty-one of these have been since the Production Certificate was 
[issued] on April 26, 2007. There are 13 action items on the Project 
Certification Plan that completes the [production certificate]. Some of 
these action items are complete and some are behind schedule. Eclipse 
is scheduled to complete the action items by the end of the year. 

The 13 remaining findings included requirements addressing Eclipse’s oversight of its 
suppliers and adherence to its own quahty assurance processes. For example, 
corrective actions to address these 13 findings included the following: 

• Establish new procedures for Eclipse to inspect its suppliers on site. 

• Establish new procedures to inspect parts received from foreign suppliers. 

• Develop and submit a “shelf-life” policy to determine when certain aircraft parts 
have expired (e.g., sealants, engine oil, and fluid compounds). 

• Develop procedures to protect parts vulnerable to damage from electrostatic 
discharge (i.e., parts/software that could be damaged by power surges and other 
electrical shock). 

• Perform an internal audit of its quality assurance processes. 

Additionally, before Eclipse received its production certiflcation, it encountered 
numerous problems replicating its own aircraft design on the factory floor, A 
significant concern was that manufacturing deficiencies were not identified by 
Eclipse’s ODAR inspectors designated to certify aircraft airworthiness. For example, 
in one instance, Eclipse presented an aircraft to FAA for airworthiness certification 
with approximately 20 airworthiness deficiencies, even though an FAA-approved 
ODAR inspector had previously inspected the aircraft for airworthiness and found no 
non-conformities . 

Other examples of deficiencies FAA identified included improperly installed fasteners 
on the wings, oxygen lines routed across control cables, and wires chafed by the 
airframe. Aircraft also failed functional test procedures for critical systems such as 
landing gear, communications, flaps, pitch trim, fire protection, and transponders. 

FAA inspectors told us that Eclipse repeatedly submitted aircraft for airworthiness 
certification with previously identified discrepancies that had still not been corrected, 
and they expressed frustration over the time and resources spent inspecting aircraft 
that were clearly not ready for inspection. For example, on the first aircraft, FAA 
inspectors found deficiencies associated with the landing gear on eight separate 
inspections. Table 2 below shows discrepancies that FAA inspectors identified on the 
first three EA-500 aircraft after they were certified by Eclipse inspectors. 
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Table 2. Manufacturing Deficiencies Found by FAA Inspectors After 
Eclipse Inspectors Certified the Aircraft 


Discrepancy 

Aircrafi 1 



l-'aiied functional Tests 




Landing Gear Rigging 




Landing Gear on Extension During 

Flight Test 




Aileron Trim 

2 times 



Bleed Air Supply Subsystem (BASS) 




Cabin Pressurization 

|||||||Q2iS§|||||||| 



Electrical Power Distribution System 

2 times 



Pitot-Static System 


2 times 

3 times 

Transponder 

2 times 



Airspeed Measuring System/Air Data 
System 

3 times 

2 times 


Oxygen Mask Drop 



HBSSSH 

yVireCimfins’ 


MWIW 

HHIHII 

Numerous wire bundles on aircraft 
structure behind instrument panel 


3 times 


Engine Bleed Valve Line on insulation 

1 time 



Starter Generator cables assembly 

I time 



Multi-Functional Display Wires on the 
aircraft structure, both sides 


I time 


Loose yVMne 




Engine wiring harness to BASS module 

1 time 



Canon Plug and Wire Harnesses 

1 time 



Electrical connectors where the wings 
attach to the fuselage, left and right sides 




Weight & Balance 





Human Calculation Errors 


IIIIIIBDS9IIIH 


Rivets/Grommets/Fasteners 




Engine grommet misaligned 

1 time 



Fasteners and rivets improperly installed 


2 times 



Source: OIG analysis of FAA data 


After granting the production certiHcation, FAA audits of Eclipse supplier 
controls found significant deOciencies occurring that should have been corrected. 

During our investigation, we found that FAA inspectors conducting audits of 
Eclipse’s supplier quality control between February and August of 2008 identified 
multiple issues that should have been corrected. FAA initiated enforcement actions 
for seven out of the seven Eclipse suppliers it audited. That is, during the audits, the 
FAA inspectors identified serious non-conformities associated with aircraft parts, 
materials, or manufacturing processes used for the EA-500 by Eclipse suppliers. 
These included the following: 
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• Receiving or Accepting Non-Conforming Parts or Tools : Suppliers were not 
performing receiving inspections for parts or materials received from their 
suppliers. In addition, suppliers were producing parts using design specifications 
that were either unapproved or outdated. Suppliers also received, accepted, and 
used non-conforming materials from their suppliers. 

• Parts Not Properly Stored or Marked : Non-conforming/deficient parts were found 
on the suppliers’ shop-room floors that were not marked as deficient, which meant 
that technicians could not determine if they passed or failed a receiving inspection; 
therefore, they could have been mistakenly used in production. 

• Failure To Follow Manual Procedures : Work instructions at one foreign supplier 
were not written in English, which meant that inspectors from both the 
manufacturer and FAA could not verify that the work instructions were written as 
required. Supplier personnel were also using outdated instructions to perform 
weight and balance calculations of flight control surfaces (i.e., flaps, ailerons, 
etc.). In addition, suppliers’ certificates of conformance (a tag confirming that the 
part conforms to requirements) did not contain process specifications as required 
by the engineering documentation. 

• Uncalibrated Tools : Several gauges that require strict calibration were found 
uncalibrated. Further, these tools were not included in the database that tracks 
tool calibration (this system ensures that tools requiring calibration meet required 
specifications within required timeframes). Calibrated tools are highly sensitive 
and used in safety-critical manufactured components, such as the wing assembly 
or the actuators that control flight surfaces (i.e., flaps, ailerons, etc.). 

• Revisions to Tooling and Procedures Without Approval From Eclipse : FAA 
inspectors observed technicians hand-trimming hinge and access covers for the 
elevator (which controls aircraft pitch) without any documentation or engineering 
authorizations. In addition, one supplier revised supplier manuals, material 
specifications, process specifications, and workmanship standards with no 
evidence that the changes had been approved by Eclipse or FAA. 

Additionally, at the largest user of the EA-500, mechanics found problems with 
Eclipse supplier-manufactured parts on 26 of the 28 EA-500 aircraft operated by the 
company. Specifically, Eclipse supplier-manufactured bell cranks (which control 
aileron movement) were corroding, causing excessive friction during operation 
resulting in severe degradation and limited functionality. As a result, all 26 aircraft 
had to have their bell cranks replaced — some on more than 1 occasion. In one 
instance, an aircraft’s bell crank had to be replaced only 6 weeks after that aircraft’s 
airworthiness certificate was issued. 

The fact that these issues continued to occur post-production raises questions about 
FAA’s ability to maintain proper oversight when advancing the production of new 
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aviation technology. FAA has established good steps to oversee this process, but 
those steps were rendered ineffective since FAA treated them as mere formalities 
rather than prerequisites to certification. 

FAA’s Desire To Promote the Use of VLJs May Have Contributed to 
Its Decision To Accelerate the Eclipse Certification Process 

A significant concern surrounding this issue, Mr. Chairman, is that FAA specifically 
designated the Eclipse EA-500 VLJ as a priority project for certification. In FAA’s 
Aviation Safety line of business FY 2006 Performance Plan, FAA identified Eclipse 
as a priority certification activity, stating that it would support the operation of VLJs 
in the National Airspace System by issuing: 

... a [design certification] for a new small airplane by September 2006. 
Eclipse Aviation will obtain [a design certification] for small jet powered 
by P&W [Pratt and Whitney] 610 engines and using extensive new 
technology avionics. 

We are concerned that the specific designation of Eclipse as a priority certification 
may have resulted in undue pressure to meet the deadline, thereby resulting in reduced 
vigilance from FAA during the aircraft’s design and production certification 
processes. In FAA’s post-design certification, lessons-leamed review of the Eclipse 
project, FAA managers acknowledged that “FAA supported an aggressive 
certification schedule” and that it expended “32,000 hours; $2.0 million (salary, 
travel, and overtime costs); and hundreds of hours of [compensatory] time,” 
indicating that they believed these efforts were inappropriate. 

In fact, with authorization from FAA managers, three inspectors exceeded the number 
of overtime hours allowed by Federal regulations in their attempt to ensure Eclipse 
received its design certification by the September 2006 deadline. In addition, as a 
pre-condition to receiving design certification, FAA flew the test plane for 30 flights, 
encompassing 100 flight hours over the 2- week period preceding the 
September 30, 2006, issuance of the design certificate. 

An important point, Mr. Chairman, is that FAA met its Performance Plan deadline 
and awarded the design certification to Eclipse on Saturday, September 30, 2006. 

With the significant risks posed by a new aircraft utilizing new technology and 
produced by a new manufacturer, we would have expected that FAA would have 
exercised greater scrutiny in certifying the aircraft. In addition, because the EA-5(X) 
has advanced avionics and turbine engine technology typical of large transport aircraft 
combined with the light weight of smaller, private aircraft, it did not easily fit into 
FAA’s existing certification framework. 
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FAA chose to certify the aircraft and other VLJs using certification requirements for 
general aviation aircraft rather than more stringent certification requirements for 
larger transport aircraft. However, in FAA’s post-design certification, lessons-leamed 
review of the Eclipse project, FAA managers acknowledged that the general aviation 
certification requirements were “inadequate to address the advanced concepts 
introduced on this aircraft.” We understand that FAA is developing an NPRM to 
clarify certification requirements for VLJs. Given the issues surrounding the EA-500 
certification, FAA should expedite the NPRM to allay future concerns with this 
expanding industry segment. 

In addition to the priority certification, we identified four issues that raise concern 
regarding FAA’s safety oversight focus in this matter: (1) FAA granted Eclipse an 
ODAR appointment much earlier in the process than it has for other manufacturers, 
(2) FAA granted single-pilot operation certification for the EA-500 despite concerns 
from the FAA Flight Standardization Board and users, (3) FAA replaced the 
inspection team overseeing Eclipse and restricted the new team’s inspection activities, 
and (4) a former FAA engineer assigned to the Eclipse project took a position as 
Director of Certification for Eclipse. 

FAA granted Eclipse authority to certify its aircraft for airworthiness before 
approving the design, which is far earlier than it has for other manufacturers. 

FAA granted Eclipse an ODAR appointment on September 3, 2002. The ODAR 
designation allowed the company to approve and document parts as they were 
manufactured, with internal Eclipse inspectors overseeing manufacturing processes on 
FAA’s behalf. To receive an ODAR designation, FAA regulations require the 
organization to have proven experience to perform the functions for which the 
authorization was requested. 

FAA does not typically grant ODAR authority before an aircraft company obtains its 
design certification. However, FAA guidance allows for this if the organization has a 
“high probability of obtaining a production certificate.” In the case of Eclipse, FAA 
granted ODAR designation to the manufacturer 4 years before the company obtained 
a design certificate for its aircraft and 5 years before it obtained its production 
certification. 

Given that FAA must have known that Eclipse was several years away from obtaining 
design certification, we question how FAA determined the company had a “high 
probability” of receiving its production certificate. FAA has granted ODAR 
authorization prior to issuing a design certification for only one other new VLJ 
manufacturer, Adam Aircraft; however, this manufacturer is in bankruptcy. In fact, as 
shown in table 3 below. Eclipse is the only operating manufacturer to receive its 
ODAR authorization before the aircraft design was approved by FAA. 
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Table 3. FAA Approvals for Other New Manufacturers of VLJs 


Manufacturer 

Design Certificate 
Issued 

Production Certificate 
Issued 

ODAR issued 

Eclipse 

September 30, 2006 

April 26, 2007 

September 3. 2002 

Clmis 

October 23, 1998 

June 12, 2000 

September 8, 2006 

Liberty 

Aircraft 

February 19, 2004 

April 6, 2006 

November 18. 2006 

Adam Aircraft 

May It, 2005 

None 

(Company bankrupt) 

Hay 17, 2002 

Sino 

Swearingen* 

October 27, 2005 

None 

None 


* Tlie small jet from this manufacturer was not classified as a VLJ because of its weight, but it is often used for comparison 
purposes to the Eclipse certification because it was desigp cwtified by the same FAA office during die same time period. 

Source: OIG analysis of FAA data 


It is unclear why FAA determined that Eclipse met the qualifications to perform its 
own inspections since Eclipse was a new manufacturer with no history of 
manufacturing an aircraft or shepherding a design through the design certification 
process. In our view, these facts should have raised questions regarding Eclipse’s 
ability to perform this function. As discussed earlier, FAA inspectors found 
numerous deficiencies on planes that had been inspected and approved by Eclipse 
inspectors with ODAR designations. This would indicate that FAA granted early 
ODAR authority in an attempt to expedite the certification process, rather than 
granting it as a result of diligent and thorough oversight. 

We also found evidence indicating that the individuals selected for the Eclipse ODAR 
may not have been fully qualified to perform inspection tasks. For example, when 
one FAA principal inspector showed improperly installed fasteners to Eclipse ODAR 
authorized representatives, they could not articulate how to inspect for proper 
installation. The FAA inspector expressed significant concerns that the ODAR 
representatives lacked sufficient knowledge to certificate the airworthiness of aircraft. 

In our opinion, FAA should carefully evaluate the propriety of granting ODAR 
authority for new, inexperienced manufacturers prior to design certification, 
especially in the case of light-weight aircraft that rely heavily on new technology. 
Further, FAA’s ODAR designation process should more thoroughly evaluate 
designees’ skill level and experience and ensure that the company designees are 
allowed to conduct their inspections properly and without interference from the 
manufacturer. In the case of Eclipse, FAA’s post-design certification, lessons-learned 
review noted that [ODAR] designees “reported pressure by the company to make 
submittals before data was [sic] complete.” 
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FAA granted single-pilot certification for the EA-500 despite concerns from the 
Flight Standardization Board and users: Eclipse originally envisioned and 
designed the EA-500 as a single-pilot aircraft with the goal of marketing it to 
individual owners. However, pilots reported in-flight concerns (e.g., complexity of 
new software, cockpit display “freezing,” discrepancies with airspeed and altitude 
indicators, and a minimally effective autopilot system) that could create an undue 
burden on a single pilot. Because of these factors and the level of the aircraft’s 
functionality at the time, FAA’s Flight Standardization Board determined on 
December 13, 2006, that the aircraft required a two-pilot crew. 

Despite the concerns raised by FAA’s Flight Standardization Board, the President and 
Chief Executive Officer of Eclipse initiated a customer service complaint on 
December 15, 2006, against the Board to protest its two-pilot recommendation for the 
aircraft. In a December 21, 2006, response to Eclipse, the Director of Flight 
Standards Service agreed with the company’s assertions without additional testing or 
information, stating that he “wanted to assure [Eclipse] that Flight Standards will do 
everything possible to work with Eclipse Aviation in assuring a successful conclusion 
to our efforts.” 

An important point, Mr. Chairman is that on January 29, 2007, FAA rescinded the 
recommendation and determined that a single pilot could operate the aircraft at the 
aircraft’s existing level of functionality. 

Yet, the overseas equivalent to FAA, the European Aviation Safety Agency (EASA), 
has declined to certify the EA-500 for operation in Europe. EASA’s primary concern 
is that single-pilot operation is unsafe due to the lack of normally required equipment 
on the aircraft, such as a robust autopilot system. Conversely, EASA certified the 
Cessna Mustang VLJ, which had the necessary equipment to meet its level of 
certification, with no additional requirements. 

We spoke with pilots at the largest operator of Eclipse aircraft, one of whom stated 
that he “lacked confidence that the aircraft could be operated safely by a single pilot.” 
These concerns are even more significant considering that the pilots we spoke with 
have considerable amounts of commercial flying time. Further, they work for a 
company that has well-organized flight operations and dedicated maintenance support 
and uses two-pilot flight operations with the EA-500. This company also worked 
closely with the manufacturer to develop its own solutions for problems discovered in 
its fleet of purchased Eclipse aircraft. By contrast, a single pilot or owner is likely to 
have less flight experience and no dedicated maintenance or flight operations support. 
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FAA replaced the inspection team that had identifled deOciencies at Eclipse and 
limited inspection activities. We found that FAA replaced the original FAA 
inspectors on the Eclipse project and limited the replacement team from thoroughly 
inspecting the aircraft. At this point, in March 2007, Eclipse had received the design 
certification, and its aircraft were undergoing FAA airworthiness inspections. These 
were required as the company had not yet received its production certification. Upon 
receipt of this certification, the company would be able to mass produce the aircraft 
without FAA certifying the airworthiness of each individual aircraft. 

After multiple incidents of aircraft being presented to FAA for airworthiness 
certifications when numerous deficiencies existed, the manager of the FAA 
manufacturing inspection office sent an e-mail to Eclipse on February 26, 2007, with 
the approval of his supervisor. 

In the e-mail, he detailed all of the steps that Eclipse needed to complete to comply 
with FAA requirements for obtaining an airworthiness certificate. According to FAA 
officials we spoke with. Eclipse senior management believed these requirements 
exceeded the FAA regulations and complained to officials within FAA Headquarters. 
In March 2007, FAA Headquarters officials removed the FAA manager who sent the 
e-mail from the project, stating that he had stepped outside his authority in laying out 
the regulatory requirements to the manufacturer. 

We spoke with other FAA managers, including the supervisor of the removed 
manager, and they stated that the steps outlined in the e-mail were appropriate 
because FAA is ultimately responsible for certifying the airworthiness of each new 
aircraft. Specifically, FAA Order 8 1 30.2F places the responsibility on FAA to ensure 
that each aircraft manufactured under its design certificate meets the approved design 
and is in condition for safe operation. 

FAA Headquarters officials also removed the Directorate Manager in charge of both 
the manufacturing inspection and design certification offices from the Eclipse project. 
In a six-page letter of reprimand, FAA officials stated that the Directorate Manager 
failed to meet expectations associated with meeting its customer service initiatives. 
Specifically, the letter stated that he needed to “build relationships with our customers 
and achieve operational results.” The letter further stated “your personal relationship 
with the Eclipse Executives is deficient. As [Eclipse is] one of your major customers 
we expect you to work to improve the relationship.” 

In fact, FAA Headquarters officials required the Directorate Manager to undergo a 
peer appraisal, consisting of a 360° review (i.e., a process for collecting observations 
from multiple sources about individual performance) and invited the Chief Operating 
Officer of Eclipse to be one of the individuals appraising his performance in 
certifying the EA-500. While the Directorate Manager’ s supervisors were the group 
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that rated him lowest, the Directorate Manager’s customers were the group that rated 
him the highest. 

With the removal of the local inspection manager, the Directorate Manager, and other 
FAA inspectors who repeatedly identified discrepancies, the FAA Headquarters 
Director of Aircraft Certification at FAA Headquarters assigned his former deputy 
responsibility for managing oversight of the Eclipse certification project. The deputy 
assembled a new team of inspectors and developed a policy that limited the 
inspectors’ ability to fully inspect the aircraft for airworthiness. The deputy was also 
selected as a member of the FAA Special Certification Review Team, which recently 
concluded that the design certification of the EA-500 met FAA standards. 

Specifically, FAA’s Production Certification Plan did not require Eclipse employees 
to remove floorboards or interior panels for FAA inspectors. Before this policy was 
established, FAA inspectors had found numerous deficiencies on planes that had 
already been inspected and certified by ODAR-designated Eclipse inspectors. 

In FAA’s post-design certification, lessons-leamed review of the Eclipse project, 
FAA managers acknowledged that “issues were not worked at the appropriate levels 
in the organization.” In our view, FAA’s actions in this instance present a troubling 
picture of the production certification process for the EA-500 and underscore our 
concerns that the Agency focused primarily on promoting new aviation technology 
rather than ensuring proper safety oversight. 

A former FAA engineer assigned to the Eclipse project became Eclipse’s 
certiflcation director. During our review, we were concerned about an unusual set 
of circumstances surrounding the former FAA project officer on the Eclipse 
certification project. The engineer worked on the Eclipse certification project from 
January 2000 until October 2001. In his capacity as the project officer for FAA, the 
engineer evaluated and approved Eclipse’s proposed methods for meeting FAA’s 
certification requirements for the design phase of the aircraft. 

When he left FAA, he immediately went to work at Eclipse as the Director of 
Certification. In his new role with Eclipse, he served as the focal point between 
Eclipse and FAA regarding the company’s compliance with FAA’s certification 
requirements. Essentially, he performed the same function for the company as he did 
under FAA, with no consideration given to any potential conflicts of interest. 

We have previously recommended that FAA revise its post-employment guidance for 
aviation safety inspectors to require a “cooling-off’ period when an FAA inspector is 
hired at an air carrier he or she previously inspected. To avoid potential conflicts of 
interest, FAA should also consider applying this requirement when aircraft 
certification inspectors or engineers leave the Agency for employment with private 
aviation companies that they previously regulated. 
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FAA Must Take Immediate Actions To Ensure That Continuing 
Problems Reported by Eclipse Users Are Quickly Resolved 

Mr. Chairman, the results of our investigation and those of the NTSB, as well as 
concerns expressed by EA-500 users and FAA employees, clearly underscore the 
need for FAA to take immediate actions to ensure that existing problems reported by 
Eclipse users are quickly resolved. 

Last month, at our recommendation, FAA established a Special Certification Review 
Team to verify that Eclipse corrects design and production problems associated with 
the EA-500 and determine that the aircraft is in condition for safe operations. The 
team completed its assessment last week and concluded that the certification of the 
EA-500 was appropriate for the areas reviewed. We received a copy of the team’s 
report on Saturday and are reviewing its findings and recommendations. However, 
based on the interim results of our investigation, we are recommending that FAA take 
the following actions; 

1 . In view of the problems we have identified, FAA must reassess the propriety of 
its single-pilot certification for the EA-500. 

2. FAA must expedite its NPRM to clarify certification requirements for the 
expanding VLJ industry segment given the differences between certification 
requirements for large transport and general aviation aircraft. 

3. FAA should carefully evaluate the propriety of granting ODAR authority to new, 
inexperienced manufacturers prior to design certification. Further, FAA’s 
ODAR designation process must more thoroughly evaluate designees’ skill level 
and experience and ensure that the company designees are allowed to conduct 
their inspections properly and without interference from the manufacturer. 

4. FAA must discontinue prioritizing specific manufacturers’ programs in its 
Performance Plan for special attention to prevent any appearance of favoritism 
or the perception of diminished vigilance in its oversight mission. 

5. FAA must implement a “cooling-off’ period for its aircraft certification safety 
inspectors and engineers before allowing them to accept positions with the 
manufacturers they formerly regulated. 

That concludes my testimony, Mr. Chairman. I would be happy to answer any 
questions you or other Members of the Subcommittee may have. 
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U.S. Department of Transportation 
Office of Inspector General 
Questions for the Record 

Subcommittee on Aviation, Committee on Transportation and Infrastructure, 
U.S. House of Representatives 
November 3, 2008 

Chairman Costello 


Question #1: Could you provide the Committee your views on the FAA Special 
Certification Review Team’s Report on the type certification of the EA-SOO 
VLJ? 

Based on the preliminary results of our investigation of the EA-500 very light jet 
(VLJ) certification, we recommended that the Federal Aviation Administration 
(FAA) independently verify that the certification process was conducted 
appropriately. The Special Certification Review (SCR) was a good first step in 
implementing this recommendation. The SCR was conducted by a panel of highly 
regarded experts who were tasked with determining if the design certification 
(type certificate) of the EA-500 met regulatory requirements in four specific areas: 
cockpit displays/screen blanking, stall speeds, trim, and flaps. The SCR team 
concluded that the certification process met regulatory requirements in these four 
areas. 

However, the SCR team did not review any of the issues surrounding the 
EA-500’s production certification. Further, one of the SCR team members (an 
FAA Senior Advisor) had been directly involved in the production certification 
process, which could have affected the panel’s independence. We will continue 
reviewing issues related to the production certification and report on them early 
next year. 


Question #2; Are you aware of any certification processes in which FAA issued 
an lOV, allowing an aircraft to be certified despite known deficiencies with the 
understanding that they could correct these issues later? 

During our review, FAA inspectors told us that it was not unusual to accept an 
lOU with action items during aircraft certification. At this time, we do not know 
if FAA has accepted lOUs for safety-critical items on other aircraft types, as it did 
for the avionics software on the EA-500. We intend to explore this area in greater 
detail as we move forward with our review. 
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Under FAA’s current guidance, there are two ways by which FAA can allow an 
alternative means of compliance to a regulatory requirement if the manufacturer 
demonstrates that its technology meets the intent of the existing regulation: 

(1) Grant a waiver. 

(2) Make an Equivalent Level of Safety Finding. 

FAA accepted an lOU from Eclipse stating that the software used in the aircraft’s 
cockpit instrumentation would meet accepted industry standards at a later date. 
FAA’s current regulations do not allow lOUs to be accepted as an alternative 
means of showing compliance for certification; therefore, this action represented a 
deviation from FAA’s own regulatory framework. Since Eclipse was a new 
manufacturer attempting to certify a new design that heavily relied on electronic 
cockpit instrumentation, we believe it would have been prudent for FAA to require 
compliance with accepted industry standards for software certification at the time 
the type design certificate was awarded. 


Question #3: One of the issues is that the test pilots at FAA were opposed to 
approving the aircraft for single pilot operation, yet the FAA overruled their 
own pilots. What was their justification for overruling the pilots? 

While evaluating the EA-500, the board of FAA test pilots identified numerous 
issues that they believed would require a two-pilot rating.' These included limited 
autopilot functionality, erroneous stall warnings, and blanking of the cockpit 
display screens. When these pilots presented their findings to Eclipse 
management, the Eclipse Chief Executive Officer sent a letter to the Flight 
Standards Director to protest the two-pilot recommendation and request that FAA 
review the decision under its Customer Service Initiative. Shortly after FAA 
received this letter, the test pilot board reevaluated the aircraft. As a result, FAA 
determined that Eclipse had addressed enough of the service difficulties identified 
with the aircraft during flight testing to issue a single-pilot recommendation. This 
certification was granted to the EA-500 about a month after the Eclipse Chief 
Executive Officer requested the Customer Service Initiative review. 

During our review, we found that some Eclipse operators use two pilots to fly the 
EA-500 as a matter of policy, while others use only one pilot. We spoke with a 
number of EA-500 pilots who had extensive private and commercial experience. 
Many of these pilots questioned the validity of the single-pilot certification for this 


' As part of the certification process for a new or modified aircraft, a board of FAA test pilots is charged with 
determining aircraft type rating requirements (an authorization to fly a specific type of aircraft). The FAA lest 
pilots fly and evaluate the aircraft and determine items such as training requirements and whether or not the aircraft 
can be operated safely by one pilot. 
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aircraft. Further, the problems with in-service aircraft detailed in our prepared 
statement can all potentially increase pilot workload beyond acceptable limits for 
one pilot. Accordingly, we believe that FAA should immediately review its 
single-pilot certification for the EA-500 to ensure that the aircraft is indeed safe 
for that type of operation. 


Question #4: .45 you are aware, an FAA manufacturing certification manager 
purchased professional liability insurance because of his concerns about his 
role in the certification program. Have you ever heard of a case of this 
occurring in the past? 

We are not aware of any other instances of managers purchasing professional 
liability insurance. This question would be better suited for submission to FAA 
for a detailed response. According to the certification manager’s September 
testimony, he based his decision on all of the events he had experienced and 
observed in connection with the Eclipse project. 


Question #5: In your testimony, you laid out a list of deficiencies in which FAA 
inspectors identified serious non-conformances associated with aircraft parts, 
materials or manufacturing processes used for the EA-500 by Eclipse suppliers. 
You go on to list issues with receiving and accepting non-conforming parts or 
tools, parts not properly stored or marked, failure to follow manual procedure, 
uncalibrated tools, revision of tools and procedures without approval from 
Eclipse. You also stated that at the largest user of the EA-500, FAA inspectors 
found problems with Eclipse supplier manufactured parts on 26 of the 28 EA- 
500 aircraft operated by the company. Have these issues been addressed by the 
FAA? 

At this time, we are unable to say whether all of these issues have been fully 
addressed. However, our investigation is ongoing, and this is one area that we will 
explore in greater detail. FAA identified the issues you referenced while auditing 
Eclipse’s manufacturing and production facilities and processes — including 
evaluations of its suppliers — and identified serious non-conformances associated 
with critical parts and processes. These audits are an integral part of the 
production certification process. Additionally, company mechanics at the largest 
user of the Eclipse VLJ found problems with supplier-manufactured parts on 26 of 
the 28 company-operated EA-500 aircraft. 

FAA has recently undertaken a full-scale, top-to-bottom review of Eclipse’s 
manufacturing and production processes (an Aircraft Certification Systems 
Evaluation Program [ACSEP] audit). We understand that FAA has identified non- 
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compliances across several categories, including Manufacturing Processes, 
Manufacturing Controls, and Supplier Control. Prior FAA audits at Eclipse 
identified simitar discrepancies in Eclipse’s manufacturing and supplier control 
processes. If the discrepancies identified indicate continuing or repetitive 
problems with reproducing the approved design, it will then be clear that further 
work is needed from FAA to address previously identified issues. 
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Good Morning Mr. Chairman and Honorable Members of this Committee. 

My name is Dennis Wallace. I am a software engineer employed by the FAA and I am 
currently assigned to the Rotorcraft Certification Office in Fort Worth, Texas as the FAA 
Software Technical Specialist. I have been employed by the FAA for the past twelve 
years. 

Prior to my employment with the FAA I worked for the Department of Defense in 
various positions for twenty-six years. I am also a veteran of the United States Air Force, 
having served four years on active duty and twenty-one years on active reserve. 

I am here before you today to give an account of my recollection of the events in the final 
days leading up to the issuance of an FAA Type Certificate for the Eclipse 500 very light- 
jet airplane, which is being developed and manufactured by the Eclipse Corporation, in 
Albuquerque, New Mexico. 

My specific role in this project was to provide typical FAA certification oversight of 
Eclipse and its’ suppliers development of airborne software for this aircraft to ensure that 
it satisfied the safety requirements defined in the applicable Federal Aviation 
Regulations. According to what the company submitted, and FAA agreed to, aircraft 
level Plan for Software Aspects of Certification (PSAC), Eclipse and its’ suppliers were 
to develop their software in accordance with the guidelines of RTCA DO-178B as a 
means to secure FAA approval of their digital computer software as a showing of 
compliance to 14 CFR 23.1301 and 14 CFR 23.1309. As there are no specific regulations 
that discuss how to certify software, these are the governing safety regulations and DO- 
178B is the standard, FAA recommended approach for the certification aspects of 
airborne software. 

DO-178B was published in 1992 and has become the universally accepted governing 
procedure for such software certification efforts. DO-1 78B uses layers of checks and 
balances in an attempt to prevent errors from manifesting in the code. These include a 
defined and structured development process, independent peer reviews, quality assurance, 
configuration management and the rigor of testing that must be accomplished. 

I was initially assigned to work on this project in 2001 and since that time I have been the 
primary person at the FAA responsible for oversight of the software certification 
activities on this project, which also included the conduct of numerous software 
development audits at Eclipse and also at its’ suppliers. 

On the morning of Tuesday, September 1 2“' 2006, while conducting a software review at 
one of Eclipse’s suppliers, 1 received a telephone call from the FAA program manager of 
the Airplane Certification Office, ASW-1 50, informing me that 1 needed to attend a 
meeting at a hotel in Albuquerque on Wednesday evening, September 1 3*’’ 2006 and that 
I should be prepared to give a status report for the software being developed by that 
particular supplier. When 1 arrived for that meeting, 1 was prepared to report to those 
attending the meeting the facts that the supplier had not yet completed final design 
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review, had not entered test readiness review, and that the company was aware that “dead 
code” (inactive code) still needed to be removed. Most importantly, I was also going to 
report that, in my opinion, only approximately one-third of the required objectives of 
RTCA DO-1 78B had been satisfied. 

Instead of support, what I received was a rather harsh line of questioning from the FAA 
AIR- 1 and AIR- 1 00 managers that basically questioned the validity and utility of the 
long-accepted RTCA DO-178B software certification procedure. They also harped on 
the fact that there were no airworthiness rules specifically related to software 
certification. 

I tried to explain to them that Eclipse had signed up to comply with DO-178B for 
themselves and their suppliers via the aforementioned aircraft level PSAC. I went on to 
state to them that while it is true that there are no Part 23 rules that are unique to software 
approval, DO-178B is a traditionally and universally accepted means to secure FAA 
approval for digital computer software as a showing of compliance to the general rules 14 
CFR 23.1301 and 14 CFR 23.1309, which are applicable to all Systems & Equipment 
onboard the aircraft. Also, DO-1 78B provides a level playing field for all aircraft 
software developers and, as such, it has contributed to a standardized approach to the 
software aspects of certification - standardization being a goal which FAA management 
has publicly espoused and promoted to its workforce for years. As an aside, I told them 
that this was how I teach software aspects of certification to all of the FAA engineers at 
the FAA Academy and if I was doing this incorrectly, then maybe we need to change the 
course content to reflect how it should be done. 

I was told by the AIR-1 manager in what I perceived to be a very direct, animated, and 
threatening manner, that my position on this constituted “antiquated thinking” and that I 
best “start thinking outside the box.” He further stated that we were here to “save a 
company” and then, looking directly at the then Rotorcraft Directorate manager, said he 
“shouldn’t have to come to Albuquerque to do his job.” That was when 1 realized two 
things: 1) The supplier was not the problem- 1 was perceived by management to be the 
problem - because I wasn’t going to accept the software since it had not been shown by 
the applicant to be compliant to the applicable safety regulations, and 2) The bus had 
already left the station and not only was I not on the bus, I felt I was being thrown under 
it. I remained silent for the rest of the meeting because it was clearly evident from the 
statements made that management intended to drive the bus on this certification effort 
and that they would not listen to me, despite the fact that I felt I had greater cognizance of 
both the project design and the governing applicable regulations. My reference to “the 
bus” here stems from a book that FAA management has promoted as a must read on 
management technique. 

On the following morning, Thursday, September 14* 2006, 1 attended a meeting at 
Eclipse, along with other FAA personnel. In attendance were, if not all, the majority of 
FAA employees from the previous evening’s FAA only meeting, and a dozen or so 
Eclipse employees. In that meeting, the company proposed a mitigation strategy that the 
company wanted the FAA to accept as an alternative to the supplier having to satisfying 
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the software objectives of RTCA DO-178B. It is my “continued” opinion to this day that 
FAA management was strongly encouraging the FAA team to accept this proposed 
company mitigation strategy. 

The next week, I telephoned the supplier’s Designated Engineering Representative 
(DER) and asked him to submit an FAA Form 8110-3 stating that the software satisfies 
DO-178B and complies to 14 CFR 23.1301 and 23.1309. I received the requested 8110- 
3s dated September 19* 2006 stating “23.1301 (a) and (d) 23.1309 (a), (b)(1) as 
applicable to the intended installation to the extent demonstrated by partial compliance 
with RTCA DO-178B.” This became part of the mitigation package (EAC R02-5014 
Rev B) for which I was asked to sign off on. I did so on September 28* 2006 by stating 
only that “I concur that the software partially complies with DO-178B.” The clear 
implication here is that neither the DER, nor I, concurred that the software was 
completely compliant. 

When I arrived at work on Monday October 2"“* 2006 I was surprised to hear that Eclipse 
had already received its’ FAA Type Certificate the previous Saturday, September 30* 
2006. Subsequent to that I went back to work on other projects and do not recall having 
any significant contact with Eclipse until the spring of 2007, when the company 
presented a design change to their AVIO system. I am currently working that design 
change project. 

This concludes my opening remarks. Thank you, Mr. Chairman and Honorable Members 
of this Committee. 
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Over the past two years, this committee has gathered many times to investigate the 
irresponsibility of the FAA. We have discussed the Administration’s failure to oversee airline 
inspections and properly staff air traffic control facilities. Today we are bringing to light yet 
another failure of the FAA - to ensure the soundness of the Eclipse 500, pioneer of the 
burgeoning Very Light Jet industry. I am here to testily to the shortcomings of the process that 
allowed such a flawed aircraft to enter the market. 

As the president of the National Air Traffic Controllers Association (NATCA), I represent 
aerospace engineers and test pilots who test every aspect of aircraft design to ensure the safety of 
pilots and passengers. These professionals are highly-skilled, well-trained and dedicated to the 
safety of the flying public. 

Beginning in July 2001 there were approximately 15 engineers and five test pilots working to 
assess the safety of the Eclipse 500 prototype. The process was proceeding normally, with 
engineers performing and overseeing a battery of tests and discovering issues to be addressed by 
the Eclipse Corporation. 

According to ordinary FAA procedure, for a new aircraft to be issued a type certificate (TC), 
each engineer responsible for testing a unique aspect of the aircraft design must sign off on the 
TC - approximately eight individuals for a project this size. These engineers are responsible for 
areas such as; electrical, software, and mechanical systems, structures (aircraft strength), and 
propulsion, while test pilots are responsible for flight testing. On the 29*’' of September 2006, a 
Friday, engineers were asked to sign off on the TC, but due to outstanding technical and safety 
concerns, refused. The following day, a Saturday that was the very last day of the fiscal year, the 
FAA abandoned its usual procedures, and FAA management granted the TC to eclipse with only 
one individual signing off. 

Two aspects of prevailing FAA culture contributed to this breach of procedure and hasty 
certification of the Eclipse 500: the close relationship between the FAA and private sector 
aviation industry players and a business plan that rewards managers for speed rather than safety. 
Both represent a deterioration of the FAA’s safety culture. 

The inappropriately close relationship between the FAA and the private sector was brought to 
light when this committee investigated the failure of the FAA to conduct aircraft inspections at 
Southwest Airlines (SWA). As a result of the relationship between SWA management and FAA 
management, the FAA failed to ground 47 aircraft that were overdue for inspection for cracks in 
the fuselage, and another 70 aircraft overdue for rudder inspections. As a result, thousands of 
flights carrying hundreds of thousands of passengers were flown in potentially unsafe aircraft. 

This situation has played out again with Eclipse. Despite persistent concerns over the safety of 
the aircraft, FAA management signed off on the plans to manufacture, sell, and fly this aircraft 
without significant restrictions. They have again shirked their responsibility as a safety 
organization and have opted instead to help support a corporate bottom line. 

There is a fundamental conflict between the goals of a business and that of the agency who 
oversees that business’s industry. A business’s goal is to make money. In the case of the Eclipse 
Aviation Corporation that means developing, manufacturing, and most importantly selling Very 
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Light Jets, Therefore, the company’s objective is to obtain the necessary certifications as quickly 
and as inexpensively as possible so that they can begin delivering aircraft to buyers. Eclipse 
wants its aircraft to be safe, both because it does not want to cause injury and because doubts 
about the safety will affect the company’s bottom line. But the ultimate responsibility for 
aircraft safety is inherently governmental and resides with the FAA, 

The FAA’s job is to ensure that - in its haste to enter aircraft into the market - aircraft 
manufacturers have not overlooked threats to the safety of their planes. The FAA’s primary 
concern must be the integrity of the aircraft and the safety of the flying public. Cost to the 
company or delays in sales should not factor into this process. 

Unfortunately, cozy relationships, coupled with the desire of many FAA employees to work for 
private sector industries after leaving the government, make many in the FAA reluctant to 
enforce safety regulations that may cost the company time and money. In the case of eclipse, 
they granted TC before the aircraft met the minimum safety level and was ready to enter the 
market. 

The second issue driving the FAA’s failure to properly test the Eclipse 500 is a flaw in the FAA 
“business plan.” In an effort to behave more like a business, the FAA “instituted a ‘Pay for 
Performance’ system that ties annual pay increases to achievement of performance targets.”' 

This system often runs contrary to the Agency’s safety mission, as performance targets are often 
based not on the quality of the technical assessment but on achieving a goal within a specified 
time frame. 

In their 2006 business plan, the Aviation Safety (AVS) division of the FAA included the goal of 
certifying a Very Light Jet (VLJ) for production by the end of the 2006 Fiscal year. As the fiscal 
year was drawing to a close the Eclipse 500 - best publicized and furthest along of the VLJs - 
had not yet achieved certification. On the last day of the fiscal year FAA management pushed 
this certification through, without receiving the appropriate sign-offs from engineers and despite 
outstanding safety concerns. According the FAA “pay for performance” standards, business plan 
goals were met, and FAA management was rewarded for expediting this process. 

Some engineers were penalized for keeping the safety of the Eclipse 500 a priority over the 
speed of certification. Several reported receiving poor performance reports based solely on the 
content of their technical findings. Because they found safety problems in the design of the 
Eclipse 500, whose correction that might result in a delay to certification, they were denied 
bonuses. 

The problem with the Eclipse 500 is not the relatively narrow issue of a faulty aircraft; it is the 
far broader issue of an Agency with flawed priorities. The FAA has abandoned its safety culture 
and shirked its responsibility to keep the flying public safe. 


hllp;//www'.faa.gov/aboul/plans_reports/like business/ 
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Recommendations: 


1. The FAA's pay for performance system should only include goals that directly address 
the degree of safety and public protection maintained. Goals mandating certification 
deadlines encourage management to pressure their employees into hasty certification, 
potentially compromising the integrity and safety of the project. 

2. Title 49 must be amended to allow the Union to negotiate fair and professional pay 
procedures that encourage and reward compliance to the safety mission of the agency. 

3. In order to limit closeness between the agency and the corporations it oversees, 
engineering project leads should be assigned on a case by case basis using either a round 
robin or bidding system. No individual should be regarded as a permanent liaison to a 
particular company. 
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